CVE-2026-74445 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: reject DX_BIND_QUERY without a DX context
vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob().
All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the VMware graphics driver implementation in the Linux kernel's direct rendering manager subsystem, specifically affecting the vmwgfx driver that handles virtualized graphics operations for vmware virtual machines. The flaw manifests as a NULL pointer dereference that occurs when userspace applications submit specially crafted command buffers through render-node file descriptors. The vulnerability stems from the vmw_cmd_dx_bind_query() function which processes DirectX query binding commands without proper validation of the associated context structure, creating an exploitable condition that can be triggered by any user with access to a render-node file descriptor.
The technical implementation flaw occurs because the function unconditionally dereferences sw_context->dx_ctx_node->ctx pointer without first verifying that dx_ctx_node is properly initialized. When userspace submits an execbuf operation containing SVGA_3D_CMD_DX_BIND_QUERY opcode with dx_context_handle set to SVGA3D_INVALID_ID, the kernel fails to establish a valid context node, leaving dx_ctx_node as NULL. This null pointer dereference causes immediate kernel oops and system instability, representing a classic denial-of-service vulnerability that can be exploited remotely by unprivileged users.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions as it represents a fundamental failure in input validation within the graphics command processing pipeline. Attackers can leverage this flaw to crash the graphics subsystem or potentially escalate privileges if they can control the execution flow through additional attack vectors. The vulnerability affects all systems running Linux kernels with VMware graphics support and demonstrates poor defensive programming practices where error conditions are not properly handled before proceeding with critical operations.
The fix implements a defensive pattern consistent with other DirectX command handlers within the same driver by using VMW_GET_CTX_NODE() macro to validate context node existence before processing commands. This approach ensures that invalid or missing contexts are rejected early in the command processing cycle with proper -EINVAL error codes rather than allowing execution to proceed into dangerous NULL pointer dereference scenarios. The mitigation strategy aligns with common security practices found in CWE-476 (NULL Pointer Dereference) and follows ATT&CK technique T1059.008 (Command and Scripting Interpreter: PowerShell) patterns where early validation prevents exploitation of input handling flaws. This remediation approach prevents the publication of relocation state that would otherwise be corrupted by the null pointer dereference, maintaining kernel stability while providing proper error reporting to userspace applications.