CVE-2026-19199

Low risk· EPSS 3%

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

Software run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation.

Risk Assessment

This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.

Recommendation

Update the GPU driver to a patched version. Restrict unprivileged GPU access.

Other vulnerabilities in GPU kernel mode driver

CVE-2026-74912Low risk· EPSS 3%
On GPU systems with the fix for CVE-2026-49746 applied, the graphics buffer mapping range is limited, causing errors when mapping outside that range. Integer truncation when mapping GPU buffer pages in the 0GB-4GB range produces errors and limits kernel mode driver functionality.

Original NVD description (English source)

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS