CVE-2026-74444

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division<br /> <br /> vmw_cmd_draw() computes<br /> <br /> maxnum = (header-&gt;size - sizeof(cmd-&gt;body)) / sizeof(*decl);<br /> <br /> where header-&gt;size is u32 and is taken straight from the user-supplied<br /> command stream. When header-&gt;size is less than sizeof(cmd-&gt;body) the<br /> unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.<br /> Any user-controlled cmd-&gt;body.numVertexDecls then passes the bound and<br /> the loop dereferences decl[i] far past the end of the kernel command<br /> bounce buffer, producing an out-of-bounds read of kernel memory.<br /> <br /> Reject undersized headers up front.