CVE-2026-74445

drm/vmwgfx: reject DX_BIND_QUERY without a DX context

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: reject DX_BIND_QUERY without a DX context

vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob().

All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 6af8f0571b4f07e9b102641f195e0ae3cd3a6c71Affected 9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 7eae011829f94a76470ec76f016805f508437755Affected 9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 0634d50e8b398c25bd07c96b048e484d22688c26Affected 9c079b8ce8bf8e0394149eb39c78b04285644bcc to before e479240a1e076ba1104236331abd62400bf1d495Affected 9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 6b1eb0b63cc153e1c0cb5ab8350950119be11947Affected 9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68dbAffected
LinuxLinux	4.20Affected before 4.20Not affected 6.1.191 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 6af8f0571b4f07e9b102641f195e0ae3cd3a6c71Affected
9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 7eae011829f94a76470ec76f016805f508437755Affected
9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 0634d50e8b398c25bd07c96b048e484d22688c26Affected
9c079b8ce8bf8e0394149eb39c78b04285644bcc to before e479240a1e076ba1104236331abd62400bf1d495Affected
9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 6b1eb0b63cc153e1c0cb5ab8350950119be11947Affected
9c079b8ce8bf8e0394149eb39c78b04285644bcc to before 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68dbAffected

LinuxLinux

4.20Affected
before 4.20Not affected
6.1.191 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.