CVE-2026-74445: drm/vmwgfx: reject DX_BIND_QUERY without a DX context
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: reject DXBINDQUERY without a DX context
vmwcmddxbindquery() unconditionally dereferences swcontext->dxctxnode->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dxcontexthandle == SVGA3DINVALIDID and a SVGA3DCMDDXBINDQUERY opcode in the command stream: dxctxnode is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmwresourcesreserve() via vmwcontextgetdxquerymob().
All sibling DX handlers fail-close on a missing dxctxnode using VMWGETCTXNODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74445?
CVE-2026-74445 has a risk severity rating of 40.
How does CVE-2026-74445 affect the Linux kernel?
CVE-2026-74445 affects the Linux kernel by allowing userspace to trigger a NULL pointer dereference via the vmwgfx driver.
How do I fix CVE-2026-74445?
To fix CVE-2026-74445, update to the patched version of the Linux kernel that addresses this vulnerability.
What components are impacted by CVE-2026-74445?
CVE-2026-74445 impacts the drm/vmwgfx subsystem of the Linux kernel.
Can CVE-2026-74445 be exploited remotely?
CVE-2026-74445 can potentially be exploited locally through any render-node file descriptor.