{"id":"CVE-2026-74445","summary":"drm/vmwgfx: reject DX_BIND_QUERY without a DX context","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: reject DX_BIND_QUERY without a DX context\n\nvmw_cmd_dx_bind_query() unconditionally dereferences\nsw_context-\u003edx_ctx_node-\u003ectx.  Userspace can trigger a NULL pointer\ndereference from any render-node fd by submitting an execbuf with\ndx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY\nopcode in the command stream: dx_ctx_node is left NULL and the kernel\noopses on the assignment.  The same NULL is then re-read in\nvmw_resources_reserve() via vmw_context_get_dx_query_mob().\n\nAll sibling DX handlers fail-close on a missing dx_ctx_node using\nVMW_GET_CTX_NODE().  Use the same pattern here, returning -EINVAL up\nfront before any relocation state is published.","modified":"2026-08-18T03:31:09.538566276Z","published":"2026-08-15T12:26:52.063Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74445.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26"},{"type":"WEB","url":"https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74445.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74445"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9c079b8ce8bf8e0394149eb39c78b04285644bcc"},{"fixed":"7eae011829f94a76470ec76f016805f508437755"},{"fixed":"0634d50e8b398c25bd07c96b048e484d22688c26"},{"fixed":"e479240a1e076ba1104236331abd62400bf1d495"},{"fixed":"6b1eb0b63cc153e1c0cb5ab8350950119be11947"},{"fixed":"55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74445.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"6.6.151"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74445.json"}}],"schema_version":"1.9.0"}