{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-74443",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-74443"
  ],
  "published": "2026-08-15T12:28:42Z",
  "summary": "drm/vmwgfx: bound DMA command body size against suffix pointer",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.183",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74443"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-19T16:47:12Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Exploitation requires issuing DRM_IOCTL_VMW_EXECBUF with a crafted SVGA command batch via /dev/dri/card* or /dev/dri/renderD*, the standard local DRM render-node path for the vmwgfx driver in VMware virtual machines.\nAC:L - The attacker fully controls execbuf command layout and can set an undersized SVGA_3D_CMD_SURFACE_DMA header->size so the suffix pointer underflows into the prior command; no races, rare configs, or victim-dependent heap layout are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local user with access to the DRM render node (typically membership in the render/video group on VMware guests) can reach vmw_cmd_dma without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the DRM device and submitting a malicious execbuf ioctl; exploitation does not depend on another user mounting filesystems or performing other actions.\nS:C - The bug is a TOCTOU on the device-visible SVGA command stream: verifier writes clobber already-checked fields (GMR id, surface id, DMA bounds) in the bounce buffer before submission to the VMware virtual GPU, bypassing guest/host isolation enforced by command authentication.\nC:H - Rewriting authenticated GMR/surface identifiers or inflating maximumOffset can authorize SVGA surface DMA reads (including SVGA3D_READ_HOST_VRAM) beyond validated guest buffer bounds, yielding arbitrary guest memory disclosure and plausible host VRAM reads via the virtual device backend.\nI:H - Clobbering verified command fields lets a later command rewrite another's GMR id, surface id, or DMA limit so the hypervisor executes unauthorized SVGA3D_WRITE_HOST_VRAM or guest GMR DMA, enabling arbitrary memory write and code-execution primitives typical of kernel heap corruption.\nA:H - Corrupting the bounce-buffer command stream before FIFO submission can panic the guest kernel (invalid SVGA commands/resources) and enables repeatable denial of service; memory corruption in the verifier path is independently rated High per kernel CVSS guidance."
    }
  }
}