CVE-2026-49743: Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/writ
Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs.
During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-49743
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-497430.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-49743 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Software installed and
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-49746: Software installed and run as a non-privileged user may conduct improper GPU system calls to c…nvd · 2026-08-07
- unknownCVE-2026-45204: Software installed and run as a non-privileged user may conduct improper GPU system calls to t…nvd · 2026-08-07
- highCVE-2026-49745: Kernel software installed and running inside a Guest VM may post improper commands to the GPU …nvd · 2026-07-24
- highCVE-2026-49744: Kernel software installed and running inside a Guest VM may post improper commands to the GPU …nvd · 2026-07-24
- highCVE-2026-16157: Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate…nvd · 2026-07-22
- unknownCVE-2026-61828: Nixpkgs is a collection of software packages that can be installed with the Nix package manage…nvd · 2026-07-15
More from NVD Recent CVEs
- highCVE-2026-19190: A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part …2026-08-07
- unknownCVE-2026-49746: Software installed and run as a non-privileged user may conduct improper GPU system calls to c…2026-08-07
- unknownCVE-2026-45204: Software installed and run as a non-privileged user may conduct improper GPU system calls to t…2026-08-07
- unknownCVE-2026-45198: Kernel software from a non-secure operating system on a platform with Trusted Execution Enviro…2026-08-07
- highCVE-2026-19189: A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue …2026-08-07