CVE-2026-74445

Received Received - Intake

Null Pointer Dereference in Linux Kernel vmwgfx Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob(). All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74445

EUVD

EUVD-2026-59752

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the VMware graphics driver (vmwgfx). It involves a NULL pointer dereference in the drm/vmwgfx component when handling DX_BIND_QUERY operations without a valid DX context. The issue occurs when userspace submits a malicious execbuf command with an invalid dx_context_handle, causing the kernel to crash with an oops.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/vmwgfx driver and requires kernel-level access to detect. It involves a NULL pointer dereference in the vmw_cmd_dx_bind_query function. Detection would typically involve checking kernel logs for oopses or crashes related to the vmwgfx driver after submitting a malicious execbuf command with dx_context_handle set to SVGA3D_INVALID_ID.

Impact Analysis

This vulnerability could allow a local attacker with access to a render-node file descriptor to crash the system by triggering a kernel oops. This may lead to denial-of-service conditions, system instability, or potential privilege escalation if combined with other exploits.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel issue related to a NULL pointer dereference in the vmwgfx driver. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Since this is a kernel driver vulnerability, updating to a patched kernel version is the primary mitigation. If immediate patching is not possible, consider disabling the vmwgfx driver if it is not required for your system.

Hi! I’m here to help you understand CVE-2026-74445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70