SB20260816276 - NULL pointer dereference in Linux kernel drm vmwgfx driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-74442)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in vmw_vkms_cleanup() when cleaning up the vmwgfx vkms workqueue after initialization failure. A local user can trigger module initialization failure and subsequent cleanup to cause a denial of service.

The issue is triggered when vmw_vkms_init() leaves crc_workq unset and later module unload invokes cleanup.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/05eaa887e7b4f40fba425f8a1d7a5a8a043092a6
• https://git.kernel.org/stable/c/0ee0532f1d405d37f38c44cbba87342e63d3bbd4
• https://git.kernel.org/stable/c/7c701778c6a369769992614dac8dc00c8ac72afc
• https://git.kernel.org/stable/c/96efee36453b697ccbaf75091b7a1807c11809dd