CVE-2026-74445

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the Linux kernel within the drm/vmwgfx component. The function vmw cmd dx bind query() unconditionally dereferences sw context->dx ctx node->ctx. A user can trigger this issue from any render-node file descriptor by submitting an execbuf containing a SVGA 3D CMD DX BIND QUERY opcode in the command stream while setting the dx context handle variable to SVGA3D INVALID ID. This results in dx ctx node remaining NULL, causing a kernel oops during assignment. Additionally, the same NULL value is re-read in vmw resources reserve() through the vmw context get dx query mob() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.