A logic flaw in the VMware graphics driver of the Linux kernel allows the vmw_vkms_init() path to leave an uninitialized workqueue pointer in the vmw structure. During driver cleanup, the empty pointer is passed to destroy_workqueue(), causing the kernel to dereference a NULL pointer and crash. The crash results in a kernel panic, taking the entire system offline. This vulnerability does not provide an attacker with the ability to execute arbitrary code; its main impact is to render the host inoperable. The weakness is a classic NULL pointer dereference (CWE‑476).

The flaw occurs in the Linux kernel’s vmwgfx driver. Any installation of a Linux kernel that includes the vmwgfx module and lacks the fix from the referenced commit is affected. The kernel version is not explicitly listed in the source, but the commit references the working tree for the current mainline kernel. System owners need to verify whether their kernel build includes the abcde8… patch or a subsequent kernel release that incorporates the change. Users running the kernel without that patch are vulnerable.

The exploitability of the vulnerability is limited to triggering a driver initialization failure, which can be induced by memory pressure or absence of VBLANK guestinfo on the host. The patch only addresses a crash condition; there is no evidence of remote code execution or privilege escalation. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no publicly documented exploitation. Nonetheless, a local attacker could provoke a kernel panic if they can influence the driver initialization path, resulting in a denial‑of‑service of the host system. Given the lack of remote attack surface and no known exploitation, the risk is moderate, but the impact—a complete system crash—merits immediate attention.