Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-07T03:16:20.057Z",
  "pubdate": "2026-08-07T03:16:20.057Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) read and potential use-after-free (UAF) condition within the GPU subsystem. The flaw arises from incorrect validation of array indexes during GPU system calls initiated by software running as a non-privileged user.\nThe primary impact of this vulnerability includes unauthorized access to kernel memory via OOB reads and, in specific scenarios, the exploitation of GPU use-after-free conditions affecting arbitrary memory pages.\nThe affected systems comprise GPU device drivers and associated kernel components that handle low-level graphics system calls and resource management.\nThe risk implications are severe, as local unprivileged users can potentially escalate privileges, leak sensitive kernel memory contents, or induce kernel panics and denial of service conditions through memory corruption.\nAttacker capabilities are constrained to local execution, requiring the ability to run software as a non-privileged user on the target system to interact directly with the GPU driver interface.\nExploitation requirements include local access and the execution of specially crafted applications capable of issuing improper GPU system calls with manipulated array indices to trigger the validation failure.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient bounds checking and incorrect validation of array indices processed by the GPU driver during system call handling.\nWhen a non-privileged user executes software that issues maliciously crafted GPU system calls, the driver fails to properly sanitize index values supplied to internal data structures.\nThis failure leads directly to an out-of-bounds (OOB) read condition, allowing the execution context to read kernel memory addresses outside the allocated buffer boundaries.\nFurthermore, under specific operational conditions, improper memory management associated with these invalid array indices can be leveraged to induce a GPU use-after-free (UAF) state affecting arbitrary memory pages.\nThe attack flow proceeds as follows: First, the attacker establishes local execution privileges as a standard, non-privileged user. Second, the attacker interacts with the GPU subsystem by invoking specific system calls designed to pass out-of-bounds array indices to the kernel driver. Third, the lack of adequate input validation causes the driver to access memory outside the intended array limits, returning sensitive kernel memory to the user space or corrupting internal state references. Finally, cascading memory management anomalies can trigger a use-after-free condition on arbitrary pages, potentially enabling further exploitation vectors.\nThe vulnerable component is the GPU subsystem's system call handler responsible for processing array-based resource lookups and memory allocations. Authentication and network exposure are not applicable factors, as the vulnerability requires local access. Privilege requirements are minimal, needing only the ability to execute code as a non-privileged user on the host system."
}