CVE-2026-34196
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in GPU software allows a non-privileged user to perform improper GPU system calls, causing an integer overflow and mapping two GPU virtual addresses to the same physical address. After one virtual mapping is freed, the physical page can be reallocated, and the second mapping enables access to freed memory (use-after-free).
Risk Assessment
An attacker can access physical memory that has been freed and potentially allocated to another process, leading to reading or writing sensitive data or privilege escalation.
Recommendation
Immediately update GPU drivers and firmware to the latest version that fixes the integer overflow and improper memory mapping management.
Other vulnerabilities in GPU driver
See all- CVE-2025-10865High
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting, leading to a potential use-after-free.
- CVE-2025-58411High
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources and reference counting, creating a potential write use-after-free scenario.
- CVE-2026-45202Medium
Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. This is caused by memory free paths not maintaining state data of upgraded higher order allocations, potentially leading to memory leak or double free.
- CVE-2026-45201High
Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages, leading to OOB read and/or write due to improper validation. This could lead to 4K pages being treated as higher order pages and allowing access beyond the 4K threshold.
- CVE-2026-45204Medium
Software running as a non-privileged user may perform improper GPU system calls, leading to out-of-bounds access and kernel null pointer dereference in an error path. The null pointer dereference occurs in a function running in a kernel thread, causing kernel exceptions, platform instability, and denial of service.
- CVE-2026-49745High
Kernel software running inside a Guest VM can send improper commands to the GPU firmware, causing out-of-bounds memory writes outside the guest's virtualized GPU memory.
- CVE-2026-49744High
Kernel software running inside a Guest VM can send improper commands to the GPU firmware, triggering out-of-bounds memory accesses. This can be used for privilege escalation escaping virtualization boundaries.
- CVE-2026-49743High
Software run by a non-privileged user can issue improper GPU system calls to manipulate the lifetimes of synchronization objects in the kernel, leading to read/write use-after-free (UAF) conditions.
- CVE-2026-7639High
A vulnerability in the GPU driver allows a non-privileged user to execute a sequence of improper GPU system calls, leading to use-after-free. This facilitates unauthorized memory access from shader code.
- CVE-2026-34194High
Software run by a non-privileged user can perform improper GPU system calls, causing mismanagement of a mapping state for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.
Original NVD description (English source)
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping The second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.