A null pointer dereference occurs in the vmwgfx DRM driver when processing a DX_BIND_QUERY command with an invalid context handle. The kernel unconditionally dereferences a pointer that remains NULL, resulting in an oops and a kernel crash, which effectively denies service. The underlying weakness is a NULL pointer dereference, corresponding to CWE-476.

The flaw affects Linux systems that use the vmwgfx graphics driver in the kernel. All kernel versions prior to the commits referenced in the advisory are vulnerable; no specific version numbers are supplied, so any kernel that includes the outdated vmwgfx implementation is at risk.

The vendor does not list a CVSS or EPSS score, and the vulnerability is not in CISA’s KEV catalog. Triggering the crash requires a render‑node file descriptor and the submission of a crafted execbuf containing an SVGA_3D_CMD_DX_BIND_QUERY opcode with dx_context_handle set to SVGA3D_INVALID_ID. This is a local‑privilege or local‑user attack that could be leveraged by a compromised process or privileged user to force a system reboot. While the exact exploitation probability is unknown, the kernel disruption it causes is high impact.