What is the CVSS score of CVE-2026-74444?

CVE-2026-74444 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74444?

Linux kernel systems running VMware graphics virtualization contain a local privilege escalation vulnerability allowing standard users to gain administrative access, creating risk of data…. A patch is available.

How to fix or mitigate CVE-2026-74444?

Within 24 hours, identify and catalog all systems running vulnerable Linux kernel versions (prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6) and apply temporary restrictions on local user access pending patching. Within 7 days, deploy kernel patches from stable branches 6.6.151 or later across all systems following your change management procedures, prioritizing production virtual desktops and workstations. Within 30 days, verify complete remediation through automated kernel version scanning, confirm patch acceptance in baseline images, and document remediation status for audit compliance.

Linux Kernel CVE-2026-74444

EUVD-2026-59751 HIGH

2026-08-15 Linux

GHSA-m498-64hg-9w93

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Local OOB read yields high confidentiality impact; integrity impact absent for a read-only primitive; availability limited to potential kernel crash.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:26 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:26 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 12:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

vmw_cmd_draw() computes

maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);

where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory.

Reject undersized headers up front.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege shell on VMware guest OS

Delivery

Craft DRAW_PRIMITIVES command with header->size below sizeof(cmd->body)

Exploit

Submit payload via DRM device node ioctl

Execution

Unsigned subtraction wraps to ~4 GiB maxnum

Persist

Kernel loop iterates past bounce buffer boundary

Impact

Read arbitrary kernel memory contents

Access

Obtain low-privilege shell on VMware guest OS

Delivery

Craft DRAW_PRIMITIVES command with header->size below sizeof(cmd->body)

Exploit

Submit payload via DRM device node ioctl

Execution

Unsigned subtraction wraps to ~4 GiB maxnum

Persist

Kernel loop iterates past bounce buffer boundary

Impact

Read arbitrary kernel memory contents

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) local interactive or shell access to a Linux system running as a VMware guest - the vmwgfx driver is only active on VMware SVGA II virtual hardware and is not present on bare-metal or non-VMware hypervisor configurations; (2) a low-privilege user account with read/write access to the DRM device node (/dev/dri/renderD* or /dev/dri/card*), which typically requires membership in the 'video' or 'render' group; (3) a kernel version from Linux 2.6.33 onwards with vmwgfx compiled in or loaded as a module, and not yet patched to 6.6.151, 6.12.103, 6.18.44, or 7.1.8. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N reflects a locally exploitable flaw requiring only low-privilege user access - no special configuration complexity or user interaction is needed - meaning even a mid-sized municipal IT team in mielec running VMware-based virtual desktop infrastructure should treat this as a credible local escalation risk in their VM guest OS environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with a low-privilege shell on a Linux VM running on VMware infrastructure opens the DRM render device node and submits a crafted DRAW_PRIMITIVES command with header->size set to a value smaller than sizeof(cmd->body). The unsigned subtraction wraps to approximately 4 GiB, and with numVertexDecls set to a large attacker-controlled value, the kernel loop walks far beyond the allocated bounce buffer, reading arbitrary kernel memory that may contain credentials, cryptographic material, or pointers useful for further exploitation. …
Remediation	Upgrade to a fixed Linux kernel: stable releases 6.6.151, 6.12.103, 6.18.44, or 7.1.8 are available; pre-release users should target 7.2-rc6. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and catalog all systems running vulnerable Linux kernel versions (prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6) and apply temporary restrictions on local user access pending patching. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74444 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74444

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code