VulnerabilityPublished 15 Aug 2026Updated 6 Nov 2026

CVE-2026-74442: Linux kernel · drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in 96efee36453b697ccbaf75091b7a1807c11809dd : update Linux kernel when convenient.

Data as of 6 Nov 2026, 18:03 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in 96efee36453b697ccbaf75091b7a1807c11809dd, 7c701778c6a369769992614dac8dc00c8ac72afc, 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 96efee36453b697ccbaf75091b7a1807c11809dd, 7c701778c6a369769992614dac8dc00c8ac72afc, 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6 or 0ee0532f1d405d37f38c44cbba87342e63d3bbd4.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0, < 96efee36453b697ccbaf75091b7a1807c11809dd	Fixed in 96efee36453b697ccbaf75091b7a1807c11809dd
LinuxLinux	Affected ≥ 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0, < 7c701778c6a369769992614dac8dc00c8ac72afc	Fixed in 7c701778c6a369769992614dac8dc00c8ac72afc
LinuxLinux	Affected ≥ 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0, < 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6	Fixed in 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6
LinuxLinux	Affected ≥ 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0, < 0ee0532f1d405d37f38c44cbba87342e63d3bbd4	Fixed in 0ee0532f1d405d37f38c44cbba87342e63d3bbd4
LinuxLinux	Affected =6.10	Fixed in–

AI-suggested

This issue is fixed in the Linux kernel versions identified by the commits 96efee36453b697ccbaf75091b7a1807c11809dd, 7c701778c6a369769992614dac8dc00c8ac72afc, 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6, and 0ee0532f1d405d37f38c44cbba87342e63d3bbd4. Users should update to a patched kernel version to remediate this vulnerability. No additional mitigation is required once patched.

Description

A vulnerability in the Linux kernel's drm/vmwgfx driver can cause a kernel panic due to a NULL pointer dereference when cleaning up the vkms workqueue on initialization failure. This happens because two error paths can leave the workqueue pointer NULL, but the cleanup function attempts to destroy it unconditionally. The issue is fixed by ensuring the workqueue is always allocated or by checking for NULL before destruction.

Impact

The vulnerability can cause a kernel panic (system crash) due to a NULL pointer dereference during module unload if the vkms initialization fails under certain conditions. This affects system stability but does not indicate code execution or privilege escalation. There are no known exploits in the wild.

Summary

The Linux kernel drm/vmwgfx driver has a flaw where two failure paths in vmw_vkms_init() can leave the vmw->crc_workq pointer NULL. One path occurs when vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) fails or returns an oversized buffer, causing an early return before workqueue allocation. The other occurs when alloc_ordered_workqueue() returns NULL due to memory pressure. Subsequently, vmw_vkms_cleanup() calls destroy_workqueue(NULL), which dereferences a NULL pointer leading to a kernel panic. The fix removes the early return to always allocate the workqueue and adds a NULL check before cleanup to prevent dereferencing NULL.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 18:03 UTC

Technical details

References

Community reviews

Related threats