CVE-2026-74443
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command…
- Risk score
- 68/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 15 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A high-severity vulnerability in the Linux kernel allows an attacker to rewrite authenticated fields of a command, potentially leading to a TOCTOU attack. This can be exploited by an attacker with local access.
- Affected
- {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
- Fix
- Check the linked advisory for details on the fix, as none are provided in this record.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-74443: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command… (CVSS 8.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 89 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8959-1
- https://ubuntu.com/security/notices/USN-8960-1
- https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0
- https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
- https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221
- https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4
- https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
- https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b
- https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c
- https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d
Original description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.
Last activity 3 Nov 2026. Patch Forecast updates every hour.