CVE-2026-74445

CVE CVE-2026-74445EUVD EUVD-2026-59752Published 2026-08-15T12:26:52.000ZLast changed 2026-08-17T05:19:32.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob(). All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 9c079b8ce8bf8e0394149eb39c78b04285644bcc <6b1eb0b63cc153e1c0cb5ab8350950119be11947; 4.20; 9c079b8ce8bf8e0394149eb39c78b04285644bcc <7eae011829f94a76470ec76f016805f508437755; 9c079b8ce8bf8e0394149eb39c78b04285644bcc <55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db; patch: 6.18.44; patch: 7.1.8; patch: 6.6.151; patch: 0; patch: 6.12.103; patch: 7.2; 9c079b8ce8bf8e0394149eb39c78b04285644bcc <0634d50e8b398c25bd07c96b048e484d22688c26; 9c079b8ce8bf8e0394149eb39c78b04285644bcc <e479240a1e076ba1104236331abd62400bf1d495

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.