CVE-2026-49745

Name of the Vulnerable Software and Affected Versions GPU DDK (affected versions not specified)

Description Kernel software running within a Guest VM can send improper commands to the GPU Firmware, leading to out-of-bounds memory accesses. This occurs when data is written outside the virtualized GPU memory of the Guest, specifically involving a DMA-write into firmware private data via MMU context 0 using the unvalidated sHWPerfCtlDMABuf GPU-VA. This flaw can be exploited to escalate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.