CVE-2026-74445

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker can trigger a null pointer dereference by sending a specially crafted command to the vmw_cmd_dx_bind_query() function. This can lead to a kernel crash, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate severity because exploitation requires local access to Direct Rendering Manager (DRM) render devices and results strictly in a denial of service (kernel crash) without allowing arbitrary code execution or data leakage. The issue specifically targets the vmwgfx driver, meaning only virtual machine guests configured with VMware virtual graphics are exposed, while bare-metal hardware and other virtualization platforms remain unaffected. Earlier releases including Red Hat Enterprise Linux 7 and 8 do not include the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.