CVE-2026-74444

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

vmw_cmd_draw() computes

maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);

where header->size is u32 and is taken straight from the user-supplied

command stream. When header->size is less than sizeof(cmd->body) the

unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.

Any user-controlled cmd->body.numVertexDecls then passes the bound and

the loop dereferences decl[i] far past the end of the kernel command

bounce buffer, producing an out-of-bounds read of kernel memory.

Reject undersized headers up front.