CVE-2026-49743: GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed
Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs.
During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49743?
The severity of CVE-2026-49743 is classified as high, with a CVSS score of 7.8.
How do I fix CVE-2026-49743?
To fix CVE-2026-49743, update the GPU DDK to the latest version provided by the vendor.
What type of vulnerability is CVE-2026-49743?
CVE-2026-49743 is categorized as a use-after-free vulnerability affecting GPU synchronisation objects in the kernel.
What systems are affected by CVE-2026-49743?
CVE-2026-49743 affects systems running the impacted version of the GPU DDK while executing software as a non-privileged user.
What are the potential consequences of CVE-2026-49743?
Exploitation of CVE-2026-49743 could lead to unauthorized read/write access to GPU memory, resulting in system instability or data corruption.