{"apiVersion":"1.0","identifier":"CVE-2026-74445","description":"In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob(). All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.","publishedAt":"2026-08-15T13:17:49","lastModifiedAt":"2026-08-17T06:19:40","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74445","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00168,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74445","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74445","en":"https://www.redsauce.net/en/cves/CVE-2026-74445","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74445","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74445","de":"https://www.redsauce.net/de/cves/CVE-2026-74445","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74445","el":"https://www.redsauce.net/el/cves/CVE-2026-74445"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74445"}}