{"id":"CVE-2026-74445","title":"drm/vmwgfx: reject DX_BIND_QUERY without a DX context","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: reject DX_BIND_QUERY without a DX context\n\nvmw_cmd_dx_bind_query() unconditionally dereferences\nsw_context->dx_ctx_node->ctx.  Userspace can trigger a NULL …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 6af8f0571b4f07e9b102641f195e0ae3cd3a6c71","Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 7eae011829f94a76470ec76f016805f508437755","Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 0634d50e8b398c25bd07c96b048e484d22688c26","Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < e479240a1e076ba1104236331abd62400bf1d495","Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 6b1eb0b63cc153e1c0cb5ab8350950119be11947","Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db","Linux 4.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:57:23.835750Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:46.018Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74445","references":[{"url":"https://git.kernel.org/stable/c/6af8f0571b4f07e9b102641f195e0ae3cd3a6c71"},{"url":"https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755"},{"url":"https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26"},{"url":"https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495"},{"url":"https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947"},{"url":"https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db"}],"tags":["cve.org"],"epss":0.00179,"epssPercentile":0.07517,"ingestedAt":"2026-11-05T15:02:32.552Z","slug":"CVE-2026-74445","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: reject DX_BIND_QUERY without a DX context\n\nvmw_cmd_dx_bind_query() unconditionally dereferences\nsw_context->dx_ctx_node->ctx.  Userspace can trigger a NULL pointer\ndereference from any render-node fd by submitting an execbuf with\ndx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY\nopcode in the command stream: dx_ctx_node is left NULL and the kernel\noopses on the assignment.  The same NULL is then re-read in\nvmw_resources_reserve() via vmw_context_get_dx_query_mob().\n\nAll sibling DX handlers fail-close on a missing dx_ctx_node using\nVMW_GET_CTX_NODE().  Use the same pattern here, returning -EINVAL up\nfront before any relocation state is published.\n\n## Affected\n\n- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 6af8f0571b4f07e9b102641f195e0ae3cd3a6c71`\n- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 7eae011829f94a76470ec76f016805f508437755`\n- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 0634d50e8b398c25bd07c96b048e484d22688c26`\n- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < e479240a1e076ba1104236331abd62400bf1d495`\n- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 6b1eb0b63cc153e1c0cb5ab8350950119be11947`\n- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db`\n- `Linux 4.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}