Out-of-bounds write in Linux kernel - CVE-2026-74443

Vulnerability details

The vulnerability allows a local user to modify authenticated command fields.

The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.

The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.

Affected software

How to mitigate CVE-2026-74443

External References

• https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0
• https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
• https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221
• https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
• https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c

Related Security Bulletins

• Out-of-bounds write in Linux kernel drm vmwgfx driver
• Debian update for linux