CVE-2026-49747: GPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommon
Published Nov 13, 2026
·Updated
Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.
The integer overflow caused when mapping a GPU buffer >4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.
Event History
Nov 13, 2026
CVE Published
via MITRE·02:15 AM
Data Sourced
via MITRE·02:15 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can trigger the issue?
A non-privileged local user can trigger it by running software that makes GPU system calls. The issue affects mappings of GPU buffers larger than 4 GB.
2
What impact is described if exploitation succeeds?
The integer overflow can corrupt an array length and cause out-of-bounds writes to GPU buffers. The described outcomes include kernel panics and out-of-bounds access.