CVE-2026-74444

A flaw was found in the Linux kernel's drm/vmwgfx driver. A local attacker could exploit an issue in the vmw_cmd_draw() function by providing a specially crafted DRAW_PRIMITIVES header with an undersized value. This can lead to an out-of-bounds read of kernel memory, potentially allowing for information disclosure.

A moderate impact out-of-bounds read flaw was found in the Linux kernel's drm/vmwgfx driver, which handles command streams for VMware virtual graphics devices. The vmw_cmd_draw() function computes the maximum number of vertex declarations from a user-supplied DRAW_PRIMITIVES command header without first validating that the header size is at least as large as the command body. A local attacker with access to the vmwgfx DRM device can submit a crafted command stream with an undersized header, causing the unsigned subtraction to wrap around and defeat the bounds check, so that the validation loop dereferences vertex declarations far beyond the end of the kernel command bounce buffer. This out-of-bounds read of kernel memory can crash the kernel (denial of service) and may disclose kernel memory contents. Red Hat rates this flaw Moderate with availability-only impact (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the upstream CVE rating of Important (7.8) that assumes high confidentiality and integrity impact; the current evidence supports a local out-of-bounds read and kernel crash but does not establish controlled data disclosure or any integrity impact. The affected Red Hat Enterprise Linux kernel and kernel-rt streams and Red Hat In-Vehicle OS kernel streams are marked affected with the fix deferred to a future planned kernel update, as this is a moderate-severity issue that requires local access to the graphics device. The residual risk until the fix ships is limited to local denial of service and out-of-bounds kernel memory reads by local users with access to the vmwgfx device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.