A logic flaw in the VMware graphics driver of the Linux kernel leaves vmw->crc_workq unset when vmw_vkms_init() fails, causing vmw_vkms_cleanup() to call destroy_workqueue(NULL). The dereference of a null pointer triggers a kernel panic, bringing the entire system down. The vulnerability does not provide a way for an attacker to execute code; it simply results in a denial of service. The weakness is a classic NULL pointer dereference (CWE‑476).

The flaw exists in the vmwgfx module that ships with most mainstream Linux kernel releases. Any host running the Linux kernel with the vmwgfx driver compiled in, and without the patch that adds a NULL check in vmw_vkms_cleanup(), is potentially vulnerable. The patch was merged into the mainline kernel; therefore, kernels newer than the commit that introduced the fix are protected, while older kernels or builds that did not incorporate this change remain at risk. System administrators should verify that their kernel includes the patched source (e.g., the commit referenced in the advisory) or upgrade to a recent distribution kernel. Unmodified kernels from earlier releases (< commit date) remain affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability requires an initialization failure in the vmwgfx driver, which can be caused by memory pressure or the absence of VBLANK guestinfo on the host. Such conditions are unlikely to be triggered by remote attackers, suggesting that the risk is mainly local or environmental. It is not listed in the CISA KEV catalog, further indicating that no active exploits are known. Nevertheless, the potential to crash the kernel means that a attacker or a process that can influence driver initialization could use this flaw to bring down the host, which merits prompt patching.