CVE-2026-74444

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only through the local DRM_IOCTL_VMW_EXECBUF ioctl (vmw_execbuf_ioctl -> vmw_execbuf_process -> vmw_cmd_check_all -> vmw_cmd_draw); it is not reachable from network, adjacent wireless, or physical buses.

AC:LAttack complexity, low

An attacker fully controls the user command stream and can set header->size below sizeof(cmd->body) to underflow maxnum and bypass numVertexDecls bounds; no races or victim-dependent timing are required.

PR:LPrivileges required, low

VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local process with access to the vmwgfx render node (/dev/dri/renderD*) and a user-created 3D context can submit the malicious DRAW_PRIMITIVES command without real root.

UI:NUser interaction, none

Exploitation requires only the attacker opening the render device and issuing crafted execbuf ioctls; no additional actions by another user or administrator are needed.

S:UScope, unchanged

Impact is confined to the guest kernel address space running vmwgfx (VMware SVGA virtual GPU); successful exploitation yields guest-kernel memory disclosure/corruption and privilege escalation, not a direct hypervisor/host escape.

C:HConfidentiality impact, high

Unsigned underflow makes maxnum enormous, so the vertex-declaration loop dereferences decl[i] far beyond the vmalloc command bounce buffer and reads adjacent kernel heap memory (e.g., decl->array.surfaceId) into validation paths.

I:HIntegrity impact, high

Beyond disclosure, leaked/adjacent surfaceId values can satisfy vmw_user_resource_lookup_handle and vmw_resource_relocations_apply then writes resource IDs to offsets past the bounce buffer, giving an out-of-bounds kernel write primitive.

A:HAvailability impact, high

Setting a large numVertexDecls after the bound bypass can walk far past the vmalloc allocation and fault on unmapped pages, and extensive heap corruption from relocation writes can also trigger kernel oops/panic.