What is the CVSS score of CVE-2026-74443?

CVE-2026-74443 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel vmwgfx are affected by CVE-2026-74443?

A pointer underflow vulnerability in the VMware graphics driver (drm/vmwgfx) affecting Linux kernel versions exposes virtualized environments to local privilege escalation attacks; no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-74443?

Within 24 hours, identify all VMware virtual machines running Linux guests and verify current kernel versions to determine CVE-2026-74443 exposure. Within 7 days, deploy available Linux kernel security patches addressing CVE-2026-74443 across affected guest operating systems using standard OS update mechanisms (yum, apt, zypper). Within 30 days, confirm patch deployment via vulnerability scanning and implement host-level monitoring for suspicious graphics driver access patterns.

Linux Kernel vmwgfx CVE-2026-74443

EUVD-2026-59750 HIGH

2026-08-15 Linux

GHSA-hrvm-q452-gmcq

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local DRM device access with PR:L; underflow overwrites cross-command verified fields enabling scope change to hypervisor-visible graphics state.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:26 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:26 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 12:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: bound DMA command body size against suffix pointer

vmw_cmd_dma() locates the DMA suffix at

(unsigned long) &cmd->body + header->size - sizeof(*suffix)

without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields.

Reject the command if the body is too small for the suffix to fit.

AnalysisAI

Pointer underflow in the VMware graphics driver (drm/vmwgfx) of the Linux kernel enables local low-privileged users to perform a TOCTOU attack on the DMA command stream inside a bounce buffer, allowing one crafted command to overwrite authenticated fields (GMR id, surface id) of a previously verified command. This bypasses kernel command authentication and can lead to unauthorized access to graphics memory regions or escalated privileges within a VMware guest. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local shell on VMware Linux guest

Delivery

Craft DMA command with undersized header->size

Exploit

Submit crafted command to vmwgfx DRM device

Execution

Suffix pointer underflows into prior verified command

Persist

Kernel verifier overwrites authenticated GMR/surface id

Impact

Access unauthorized graphics memory region

Access

Gain local shell on VMware Linux guest

Delivery

Craft DMA command with undersized header->size

Exploit

Submit crafted command to vmwgfx DRM device

Execution

Suffix pointer underflows into prior verified command

Persist

Kernel verifier overwrites authenticated GMR/surface id

Impact

Access unauthorized graphics memory region

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) a Linux guest operating system running inside a VMware hypervisor (VMware Workstation, Fusion, ESXi) with the vmwgfx kernel module loaded - bare-metal Linux and non-VMware hypervisors are completely unaffected; (2) a local user account with sufficient privilege to open and submit commands to the vmwgfx DRM device node (typically membership in the 'render' or 'video' group, or an equivalent capability); (3) the ability to submit at least two DMA commands sequentially to the same bounce buffer, the first legitimate and the second crafted with an undersized header. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects the local-access requirement but scores high due to the scope change (S:C), suggesting potential impact extending beyond the guest VM to the VMware hypervisor via authenticated field bypass. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged local user on a Linux guest VM running inside a VMware hypervisor submits a sequence of DMA commands to the vmwgfx device, with one command crafted to have an undersized `header->size` value. The kernel's `vmw_cmd_dma()` calculates the suffix pointer using the malformed size, causing it to underflow into the memory region of a previously submitted and already-verified command. …
Remediation	Upgrade to a patched Linux kernel release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, as confirmed by EUVD-2026-59750. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all VMware virtual machines running Linux guests and verify current kernel versions to determine CVE-2026-74443 exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74443 vulnerability details – vuln.today

Back

Linux Kernel vmwgfx CVE-2026-74443

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code