CVE-2026-49743
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
41/100
Published: 2026-07-24
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| imaginationtech | ddk | 24.2 – 26.1 |
| imaginationtech | ddk | 24.2 |
| imaginationtech | ddk | 26.1 |
References & Advisories (1)
Vendor Advisory