CVE-2026-49743

Name of the Vulnerable Software and Affected Versions GPU DDK (affected versions not specified)

Description Software run by a non-privileged user can perform improper GPU system calls to manipulate the lifetimes of synchronization objects in the kernel. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronization primitive is not properly incremented. This allows an attacker to destroy the exported fence and prematurely release the underlying primitive, leading to read/write use-after-free (UAF) conditions—a scenario where the system continues to use a memory address after it has been freed. This occurs specifically in the GPU kick function after the export fence file descriptor is closed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.