CVE-2026-74442

Received Received - Intake

NULL Pointer Dereference in VMware Virtual Kernel Mode Setting Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while still leaving the rest of the driver in a state that calls vmw_vkms_cleanup() at module unload: 1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or returning an oversized buffer -- the common case on hosts without a VBLANK guestinfo entry -- early-returned before the workqueue allocation. 2. alloc_ordered_workqueue() returning NULL on memory pressure. vmw_vkms_cleanup() then calls destroy_workqueue(NULL), which dereferences wq->name and panics. Fix the first case by removing the early return: vmw->vkms_enabled is already false on the rpci-failure path so no work will ever be queued, and allocating the workqueue unconditionally keeps the control flow simple. Fix the second case by guarding the cleanup with a NULL check, since alloc_ordered_workqueue() can still fail under low memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74442

EUVD

EUVD-2026-59749

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	vmwgfx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a crash in the vmwgfx driver when the vkms module fails to initialize properly. Two scenarios can leave a workqueue pointer NULL while the driver remains in a state that triggers cleanup at module unload. The cleanup function then attempts to destroy a NULL workqueue, causing a kernel panic by dereferencing a NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's vmwgfx driver and involves a NULL pointer dereference during cleanup. Detection requires checking kernel logs for crashes related to vmwgfx or workqueue operations. Commands like dmesg | grep -i vmwgfx or journalctl -k | grep -i vmwgfx may reveal errors. Ensure your kernel version is updated to a patched release.

Impact Analysis

If exploited, this vulnerability could cause a system crash (kernel panic) when the vmwgfx driver is unloaded, leading to denial of service. It primarily affects systems using VMware virtual graphics with the vkms module enabled, potentially disrupting operations on affected machines.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue causing a kernel panic under specific failure conditions, not a data privacy or security breach.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. If immediate updating is not possible, disable the vmwgfx module by blacklisting it in /etc/modprobe.d/. Monitor kernel logs for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-74442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70