---
id: CVE-2026-74442
title: 'drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

  Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while
  still leaving the rest of the driv…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 <
    7c701778c6a369769992614dac8dc00c8ac72afc
  - >-
    Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 <
    96efee36453b697ccbaf75091b7a1807c11809dd
  - >-
    Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 <
    0ee0532f1d405d37f38c44cbba87342e63d3bbd4
  - >-
    Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 <
    05eaa887e7b4f40fba425f8a1d7a5a8a043092a6
  - Linux 6.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:57:19.019172Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:45.879Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74442'
references:
  - url: 'https://git.kernel.org/stable/c/7c701778c6a369769992614dac8dc00c8ac72afc'
  - url: 'https://git.kernel.org/stable/c/96efee36453b697ccbaf75091b7a1807c11809dd'
  - url: 'https://git.kernel.org/stable/c/0ee0532f1d405d37f38c44cbba87342e63d3bbd4'
  - url: 'https://git.kernel.org/stable/c/05eaa887e7b4f40fba425f8a1d7a5a8a043092a6'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06129
ingestedAt: '2026-11-06T18:00:12.559Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while
still leaving the rest of the driver in a state that calls
vmw_vkms_cleanup() at module unload:

  1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or
     returning an oversized buffer -- the common case on hosts
     without a VBLANK guestinfo entry -- early-returned before the
     workqueue allocation.
  2. alloc_ordered_workqueue() returning NULL on memory pressure.

vmw_vkms_cleanup() then calls destroy_workqueue(NULL), which
dereferences wq->name and panics.

Fix the first case by removing the early return: vmw->vkms_enabled
is already false on the rpci-failure path so no work will ever be
queued, and allocating the workqueue unconditionally keeps the
control flow simple.  Fix the second case by guarding the cleanup
with a NULL check, since alloc_ordered_workqueue() can still fail
under low memory.

## Affected

- `Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 < 7c701778c6a369769992614dac8dc00c8ac72afc`
- `Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 < 96efee36453b697ccbaf75091b7a1807c11809dd`
- `Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 < 0ee0532f1d405d37f38c44cbba87342e63d3bbd4`
- `Linux >= 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 < 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.