CVE-2026-74445 - Vulnerability Details

- drm/vmwgfx: reject DX_BIND_QUERY without a DX context

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: reject DX_BIND_QUERY without a DX context

vmw_cmd_dx_bind_query() unconditionally dereferences
sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer
dereference from any render-node fd by submitting an execbuf with
dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY
opcode in the command stream: dx_ctx_node is left NULL and the kernel
oopses on the assignment. The same NULL is then re-read in
vmw_resources_reserve() via vmw_context_get_dx_query_mob().

All sibling DX handlers fail-close on a missing dx_ctx_node using
VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up
front before any relocation state is published.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference occurs in the vmwgfx DRM driver when processing a DX_BIND_QUERY command with an invalid context handle. The kernel unconditionally dereferences a pointer that remains NULL, resulting in an oops and a kernel crash, which effectively denies service. The underlying weakness is a NULL pointer dereference, corresponding to CWE-476.

Affected Systems

The flaw affects Linux systems that use the vmwgfx graphics driver in the kernel. All kernel versions prior to the commits referenced in the advisory are vulnerable; no specific version numbers are supplied, so any kernel that includes the outdated vmwgfx implementation is at risk.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is < 1%; the vulnerability is not listed in CISA’s KEV catalog. Triggering the crash requires a render‑node file descriptor and the submission of a crafted execbuf containing an SVGA_3D_CMD_DX_BIND_QUERY opcode with dx_context_handle set to SVGA3D_INVALID_ID. This is a local‑privilege or local‑user attack that could be leveraged by a compromised process or privileged user to force a system reboot. While the exploitation probability is low but non‑zero according to EPSS, the kernel disruption it causes is high impact.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9c079b8ce8bf8e0394149eb39c78b04285644bcc`	affected	< 7eae011829f94a76470ec76f016805f508437755
`9c079b8ce8bf8e0394149eb39c78b04285644bcc`	affected	< 0634d50e8b398c25bd07c96b048e484d22688c26
`9c079b8ce8bf8e0394149eb39c78b04285644bcc`	affected	< e479240a1e076ba1104236331abd62400bf1d495
`9c079b8ce8bf8e0394149eb39c78b04285644bcc`	affected	< 6b1eb0b63cc153e1c0cb5ab8350950119be11947
`9c079b8ce8bf8e0394149eb39c78b04285644bcc`	affected	< 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9c079b8ce8bf8e0394149eb39c78b04285644bcc,7eae011829f94a76470ec76f016805f508437755)`	affected	code_commit	—
`[9c079b8ce8bf8e0394149eb39c78b04285644bcc,0634d50e8b398c25bd07c96b048e484d22688c26)`	affected	code_commit	—
`[9c079b8ce8bf8e0394149eb39c78b04285644bcc,e479240a1e076ba1104236331abd62400bf1d495)`	affected	code_commit	—
`[9c079b8ce8bf8e0394149eb39c78b04285644bcc,6b1eb0b63cc153e1c0cb5ab8350950119be11947)`	affected	code_commit	—
`[9c079b8ce8bf8e0394149eb39c78b04285644bcc,55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the vmwgfx patch shown in the git commits cited in the advisory.
If immediate kernel upgrades are not possible, blacklist or unload the vmwgfx module to prevent the vulnerable driver from loading.
Disable or restrict the use of VMware SVGA 3D acceleration if it is not required, which removes the opportunity to issue DX_BIND_QUERY commands.
Continuously monitor kernel logs for vmw_cmd_dx_bind_query or vmw_resources_reserve crashes, and investigate any suspicious activity.

Generated by OpenCVE AI on August 18, 2026 at 02:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26
https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db
https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947
https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755
https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495
https://lore.kernel.org/linux-cve-announce/2026081529-CVE-2026-74445-05de@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74445
https://www.cve.org/CVERecord?id=CVE-2026-74445

History

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081529-CVE-2026-74445-05de@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74445 https://www.cve.org/CVERecord?id=CVE-2026-74445
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 14:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob(). All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.
Title		drm/vmwgfx: reject DX_BIND_QUERY without a DX context
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26 https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947 https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755 https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:26:52.063Z

Updated: 2026-08-17T05:19:32.678Z

Reserved: 2026-08-15T05:44:03.898Z

Link: CVE-2026-74445

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:49.067

Modified: 2026-08-17T06:19:40.303

Link: CVE-2026-74445

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74445 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T02:45:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object