Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-49743

GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
imaginationtech

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Imagination Technologies Graphics DDK

Default version status: unknown

  • 1.18 RTM2unaffected
  • 23.2 RTM2unaffected
  • 24.2 RTM2affected
  • 25.1 RTM2 to ≤ 25.3 RTMaffected
  • 26.1 RTM1affected
  • 26.1 RTM2unaffected

References