Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions, platform instability and denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-07T03:16:19.943Z",
  "pubdate": "2026-08-07T03:16:19.943Z",
  "executiveSummary": "This vulnerability involves an improper GPU system call handling mechanism that triggers out-of-bounds access and a subsequent kernel null pointer dereference within an error handling path. The flaw originates in a function executing within a kernel thread context, which leads directly to kernel exceptions, platform instability, and a localized denial of service.\nThe affected systems include environments where software is installed and executed as a non-privileged user with access to the GPU subsystem. The risk implications are moderate to high regarding system availability, as successful exploitation results in immediate kernel crashes or hangs.\nAttacker capabilities require local execution access, specifically operating as an unprivileged user on the host system. Exploitation requirements necessitate the ability to issue specific, improper GPU system calls designed to force execution down vulnerable error handling code paths within the kernel thread.",
  "technicalDetails": "The root cause of the vulnerability resides in flawed error path management within the GPU kernel subsystem. When a non-privileged user-space application initiates improper GPU system calls, the driver attempts to process the request and subsequently encounters an anomalous condition requiring error handling execution.\nDuring the execution of this error path within a kernel thread of execution, the driver fails to properly validate pointers or resource states before dereferencing them. This missing validation results in an out-of-bounds (OOB) access condition followed immediately by a kernel null pointer dereference.\nThe step-by-step attack flow proceeds as follows: First, an unprivileged user executes a specially crafted application on the local host. Second, this application issues malformed or improper GPU system calls to the graphics driver interface. Third, the driver processes the input, encounters an expected validation failure, and transitions into the vulnerable error handling routine.\nFourth, within the kernel thread handling the error path, the uninitialized or null pointer is dereferenced without prior checks, provoking a kernel panic or unhandled exception. This completely compromises the availability of the operating system kernel.\nRegarding authentication and privileges, network exposure is non-existent as the attack vector requires local execution. Authentication is limited to standard, unprivileged user access on the host operating system. No special privileges, capabilities, or administrative rights are required to invoke the improper GPU system calls."
}