CVE-2026-49743

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:imaginationtech:ddk::::::::
	cpe:2.3:a:imaginationtech:ddk:24.2:rtm2::::::
	cpe:2.3:a:imaginationtech:ddk:26.1:rtm1::::::

OR	cpe:2.3:o:google:android:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU impropias para manipular los tiempos de vida de los objetos de sincronización en el kernel, lo que lleva a UAFs de lectura/escritura. Durante el envío de la carga de trabajo que involucra una ’fence’ exportada por el controlador de la GPU, el contador de referencias de la primitiva de sincronización subyacente no se incrementa correctamente. Esto puede ser explotado, al destruir la ’fence’ exportada y liberar prematuramente la primitiva subyacente, lo que resulta en una condición potencial de uso después de liberación.

Information

Published : 2026-07-24 09:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-49743

Mitre link : CVE-2026-49743

CVE.ORG link : CVE-2026-49743

JSON object : View

Products Affected

google

android

imaginationtech

ddk

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2026-49743", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49743", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T17:27:36.145655Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "unaffected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "unaffected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2026-07-24T09:16:24.667", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs.\n\n\n\nDuring workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition."}, {"lang": "es", "value": "El software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU impropias para manipular los tiempos de vida de los objetos de sincronizaci\u00f3n en el kernel, lo que lleva a UAFs de lectura/escritura.\n\nDurante el env\u00edo de la carga de trabajo que involucra una \u2019fence\u2019 exportada por el controlador de la GPU, el contador de referencias de la primitiva de sincronizaci\u00f3n subyacente no se incrementa correctamente. Esto puede ser explotado, al destruir la \u2019fence\u2019 exportada y liberar prematuramente la primitiva subyacente, lo que resulta en una condici\u00f3n potencial de uso despu\u00e9s de liberaci\u00f3n."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6AACC00-5357-418B-BE7E-A698EBBF62A4", "versionEndExcluding": "26.1", "versionStartExcluding": "24.2"}, {"criteria": "cpe:2.3:a:imaginationtech:ddk:24.2:rtm2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7DB1A5B-11BE-48D4-9EF9-001EB3575F40"}, {"criteria": "cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6047F4B-B29A-44F7-8F80-8A53C1917F38"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}