CVE-2026-74443

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/vmwgfx: bound DMA command body size against suffix pointer<br /> <br /> vmw_cmd_dma() locates the DMA suffix at<br /> <br /> (unsigned long) &amp;cmd-&gt;body + header-&gt;size - sizeof(*suffix)<br /> <br /> without checking that header-&gt;size is large enough to contain both<br /> cmd-&gt;body and the suffix. An undersized header makes the suffix<br /> pointer underflow back into the previous command in the bounce<br /> buffer. The verifier later writes suffix-&gt;maximumOffset, clobbering<br /> verified fields of an already-relocated earlier command -- a TOCTOU<br /> on the device-visible command stream that lets one command rewrite<br /> another&amp;#39;s GMR id, surface id, or other authenticated fields.<br /> <br /> Reject the command if the body is too small for the suffix to fit.