---
id: CVE-2026-74445
title: 'drm/vmwgfx: reject DX_BIND_QUERY without a DX context'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: reject DX_BIND_QUERY without a DX context

  vmw_cmd_dx_bind_query() unconditionally dereferences
  sw_context->dx_ctx_node->ctx.  Userspace can trigger a NULL …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc <
    6af8f0571b4f07e9b102641f195e0ae3cd3a6c71
  - >-
    Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc <
    7eae011829f94a76470ec76f016805f508437755
  - >-
    Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc <
    0634d50e8b398c25bd07c96b048e484d22688c26
  - >-
    Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc <
    e479240a1e076ba1104236331abd62400bf1d495
  - >-
    Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc <
    6b1eb0b63cc153e1c0cb5ab8350950119be11947
  - >-
    Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc <
    55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:57:23.835750Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:46.018Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74445'
references:
  - url: 'https://git.kernel.org/stable/c/6af8f0571b4f07e9b102641f195e0ae3cd3a6c71'
  - url: 'https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755'
  - url: 'https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26'
  - url: 'https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495'
  - url: 'https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947'
  - url: 'https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db'
tags:
  - cve.org
epss: 0.00179
epssPercentile: 0.07517
ingestedAt: '2026-11-05T15:02:32.552Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: reject DX_BIND_QUERY without a DX context

vmw_cmd_dx_bind_query() unconditionally dereferences
sw_context->dx_ctx_node->ctx.  Userspace can trigger a NULL pointer
dereference from any render-node fd by submitting an execbuf with
dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY
opcode in the command stream: dx_ctx_node is left NULL and the kernel
oopses on the assignment.  The same NULL is then re-read in
vmw_resources_reserve() via vmw_context_get_dx_query_mob().

All sibling DX handlers fail-close on a missing dx_ctx_node using
VMW_GET_CTX_NODE().  Use the same pattern here, returning -EINVAL up
front before any relocation state is published.

## Affected

- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 6af8f0571b4f07e9b102641f195e0ae3cd3a6c71`
- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 7eae011829f94a76470ec76f016805f508437755`
- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 0634d50e8b398c25bd07c96b048e484d22688c26`
- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < e479240a1e076ba1104236331abd62400bf1d495`
- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 6b1eb0b63cc153e1c0cb5ab8350950119be11947`
- `Linux >= 9c079b8ce8bf8e0394149eb39c78b04285644bcc < 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.