CVE-2026-41158CWE-416

GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink

High · published June 12, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages.

Physical memory allocated and freed, without the deferred free mechanism can lead to those resources being used for read/write by the GPU after the kernel module has freed the resource.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Weakness
CWE-416 · Use After Free
Published
2026-06-12T21:57Z
EPSS history
Timeline
  • 12 JUN 21:57Z
    GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink
    cvelistv5