CVE-2026-49743

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

Traduire en français

Produits concernés

• Imagination Technologies Graphics DDK
• Imaginationtech ddk

Scores CVSS

Faiblesses (CWE)

• CWE-416

Références

• https://www.imaginationtech.com/gpu-driver-vulnerabilities/ Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories