CVE-2026-15466
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause a race condition in the destruction path of the hardware performance counters buffer, leading to a read and/or write use-after-free (UAF). The race condition could lead to the reference counter being decremented in a non-atomic way, allowing other code paths using a freed object to read and/or write kernel heap memory.
Risk Assessment
This may compromise the confidentiality and integrity of kernel memory, potentially leading to privilege escalation or system instability. The risk is significant because exploitation does not require administrative privileges.
Recommendation
Update GPU drivers to the version containing the fix for the race condition. Monitor systems for unusual GPU system calls and restrict the ability to run untrusted software.
Other vulnerabilities in GPU driver
See all- CVE-2025-10865High
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting, leading to a potential use-after-free.
- CVE-2025-58411High
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources and reference counting, creating a potential write use-after-free scenario.
- CVE-2026-65586Low risk· EPSS 3%
Software run as a non-privileged user may conduct improper GPU system calls to free memory still in use, replace it with another allocation, and cause arbitrary reads or writes to physical memory pages.
- CVE-2026-45200High
Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. The scenario is caused by fabricating a specific combination of flags on the allocation interface.
- CVE-2026-45202Medium
Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. This is caused by memory free paths not maintaining state data of upgraded higher order allocations, potentially leading to memory leak or double free.
- CVE-2026-45201High
Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages, leading to OOB read and/or write due to improper validation. This could lead to 4K pages being treated as higher order pages and allowing access beyond the 4K threshold.
- CVE-2026-45204Medium
Software running as a non-privileged user may perform improper GPU system calls, leading to out-of-bounds access and kernel null pointer dereference in an error path. The null pointer dereference occurs in a function running in a kernel thread, causing kernel exceptions, platform instability, and denial of service.
- CVE-2026-49745High
Kernel software running inside a Guest VM can send improper commands to the GPU firmware, causing out-of-bounds memory writes outside the guest's virtualized GPU memory.
- CVE-2026-49744High
Kernel software running inside a Guest VM can send improper commands to the GPU firmware, triggering out-of-bounds memory accesses. This can be used for privilege escalation escaping virtualization boundaries.
- CVE-2026-49743High
Software run by a non-privileged user can issue improper GPU system calls to manipulate the lifetimes of synchronization objects in the kernel, leading to read/write use-after-free (UAF) conditions.
Original NVD description (English source)
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS