# CVE-2026-50382 — DirectX Graphics Kernel `dxgkrnl.sys` VMBus QueryAdapterInfo Untrusted Pointer Dereference (Guest→Host RCE)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `dxgkrnl.sys` (DirectX Graphics Kernel; host virtual-GPU VMBus provider) |
| **CVE ID** | CVE-2026-50382 |
| **Impact** | Remote Code Execution (Hyper-V guest → host) |
| **MSRC severity** | Critical |
| **CVSS** | 8.8 / 7.7 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C` (**Scope: Changed**) |
| **CWE** | CWE-822: Untrusted Pointer Dereference |
| **Delivery** | A local guest VM attacks the host OS via a crafted D3DKMT QueryAdapterInfo over VMBus |
| **KB / Fixed build** | KB5101650 — `dxgkrnl.sys` 10.0.26100.8875 (Win11 24H2 / Server 2025 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `dxgkrnl.sys` 10.0.26100.8737 — SHA256 `e3bc3074fb6a89814db62de914b8c7ef595cf388226154034fa8a5002f9d93f2` |
| **Post-patch binary** | `dxgkrnl.sys` 10.0.26100.8875 — SHA256 `8ed165fcd47205c6f7d9f3db4235a20f84394da7dd0703ca8092a585da65811d` |
| **Feature flag** | `Feature_2095820091` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Cross-checked against an independent writeup — the function, the diagnostic string, and the
> `0x29` (`KMTQAITYPE_PHYSICALADAPTERPNPKEY`) constant all match the ghidriff. (The writeup
> cites `Feature_2364255544`; the analysed ghidriff gates the check with `Feature_2095820091`.)

---

## Product Description

`dxgkrnl.sys` is the DirectX Graphics Kernel. On a Hyper-V **host**, its virtual-GPU VMBus
provider (`DXG_HOST_VIRTUALGPU_VMBUS`) services D3DKMT requests forwarded by a **guest** VM.
`VmBusQueryAdapterInfo` handles the guest's `QueryAdapterInfo` request: it copies the guest's
private driver data into a host buffer and passes the request — including the guest-supplied
**`Type`** — to `DxgkQueryAdapterInfoImpl`.

---

## Vulnerability Summary

Pre-patch, `VmBusQueryAdapterInfo` passed the **guest-controlled `Type`** straight to
`DxgkQueryAdapterInfoImpl` without filtering which query types are permitted over the
guest→host VMBus boundary. For `Type == KMTQAITYPE_PHYSICALADAPTERPNPKEY` (`0x29`), the
implementation dereferences a pointer derived from the request data — an **untrusted pointer
dereference** (CWE-822) executed in the **host kernel** on behalf of the guest. Because a
low-privileged actor in the guest VM can drive this against the host (`AV:L`, `PR:L`, **`S:C`
— scope changes from guest to host**), it is a guest-to-host remote code-execution primitive
(Microsoft rates it **Critical, 8.8**).

> Confirmation level: the diff shows the fix **rejecting the query type at the VMBus
> boundary**; the specific pointer dereference inside `DxgkQueryAdapterInfoImpl` was not
> traced, so no exact memory-corruption primitive is asserted. Stated at confirmed-changed
> level, consistent with the CWE-822 classification.

---

## Prerequisites and Constraints

- Attacker has access to a **guest VM** on a Hyper-V host (`AV:L`, `AC:L`, `PR:L`, `UI:N`).
- The guest issues a D3DKMT `QueryAdapterInfo` with
  `Type = KMTQAITYPE_PHYSICALADAPTERPNPKEY (0x29)` over VMBus.
- Result (pre-patch): the host services the query and dereferences an untrusted pointer.

---

## Vulnerability Details

### Root Cause

The host VMBus `QueryAdapterInfo` handler did not restrict which `QueryAdapterInfo` types a
guest may request, so a type whose implementation dereferences request-derived pointers was
reachable across the guest→host boundary.

### The patch (confirmed — diff, .8737 → .8875)

Gated behind `Feature_2095820091`, `VmBusQueryAdapterInfo` (ratio 0.63) now **rejects
`Type == 0x29` (`KMTQAITYPE_PHYSICALADAPTERPNPKEY`) over VMBus**, logging a triage event and
returning `STATUS_INVALID_PARAMETER` instead of calling the implementation:

```c
// DXG_HOST_VIRTUALGPU_VMBUS::VmBusQueryAdapterInfo (10.0.26100.8875) — PATCHED (from the diff)
if (!Feature_2095820091__private_IsEnabled() || req.Type != 0x29) {   // 0x29 = KMTQAITYPE_PHYSICALADAPTERPNPKEY
    status = DxgkQueryAdapterInfoImpl(&req, 0, adapter);              // allowed types proceed
} else {
    WdLogSingleEntry1(2);
    DxgkLogTriageEvent(0, 0x40000, -1,
        L"Unsupported QueryAdapterInfo type over VMBus: 0x%I64x");    // *** reject at the boundary ***
    status = STATUS_INVALID_PARAMETER;                               // 0xC000000D
}
```

Pre-patch the guest's `Type` reached `DxgkQueryAdapterInfoImpl` unfiltered. With
`PHYSICALADAPTERPNPKEY` no longer serviced across the guest→host VMBus boundary, the
untrusted-pointer-dereference path is no longer reachable by a guest, closing the escape.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2095820091`.** The type restriction runs only when the flag is
enabled; the original unfiltered path still ships when disabled. Verify the flag is enabled
to confirm the fix is live. Given a guest→host RCE, apply KB5101650 or later on Hyper-V hosts
regardless.

---

## Detection Guidance

**Behavioural.** On Hyper-V hosts: triage/telemetry events "Unsupported QueryAdapterInfo type
over VMBus" (post-patch rejections) indicate a guest attempting the restricted query; on
unpatched/flag-disabled hosts, watch for `dxgkrnl` crashes in the virtual-GPU VMBus
`QueryAdapterInfo` path correlated with guest graphics activity. Keep Hyper-V hosts patched.

**Config.** The fix is CFR-gated — confirm `Feature_2095820091` is enabled.

---

## References

- MSRC advisory — CVE-2026-50382 (DirectX Graphics Kernel Remote Code Execution), released 2026-07-14, KB5101650. FAQ: guest-VM-to-host attack.
- Full binary diff: `/data/patch_diffs/dxgkrnl_sys-cve-2026-50382-ghidriff.md`