CVE-2025-58411CWE-416

GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF

High · published January 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

⚡ A non-privileged user can mess with GPU resources, leading to a potentially devastating use-after-free scenario! 🔥 Think of it like a restaurant where a waiter accidentally serves old food because the kitchen mismanages their stock. If the resources aren’t properly counted, you could be left with stale leftovers that, once taken, can cause serious health issues! An attacker could exploit this vulnerability to write to memory that should have been freed, potentially causing application crashes or allowing unauthorized access to sensitive data. The consequences could be catastrophic, leading to data corruption or system instability that might put users at serious risk.

Put simply

Think of it like a restaurant where a waiter accidentally serves old food because the kitchen mismanages their stock. If the resources aren’t properly counted, you could be left with stale leftovers that, once taken, can cause serious health issues! This vulnerability stems from improper resource management and reference counting in GPU system calls executed by non-privileged users, creating a potential use-after-free condition. This situation arises when resources are not tracked accurately, leading to unsafe memory access.

What to do

An attacker could exploit this vulnerability to write to memory that should have been freed, potentially causing application crashes or allowing unauthorized access to sensitive data. The consequences could be catastrophic, leading to data corruption or system instability that might put users at serious risk. To mitigate this risk, patch to the latest version as soon as it’s available, ensuring that proper resource management and reference counting are implemented. Additionally, conduct an audit of any user interactions with GPU resources to identify and resolve potential issues before they can be exploited. You’ve got this! With the right steps, you can secure your systems and keep your users safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-13T16:41Z
EPSS history
Timeline
  • 13 JAN 16:41Z
    GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
    cvelistv5