CVE-2026-49743: GPU Driver Use-After-Free Vulnerability

CVE-2026-49743 Overview

CVE-2026-49743 is a use-after-free (UAF) vulnerability [CWE-416] in the Imagination Technologies GPU driver. A non-privileged local user can issue crafted GPU system calls to manipulate the lifetimes of kernel synchronisation objects. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. An attacker can destroy the exported fence and prematurely release the underlying primitive, leaving stale references that permit kernel read/write access to freed memory.

Critical Impact
Local attackers with unprivileged code execution can achieve kernel-level memory corruption, potentially leading to privilege escalation and full device compromise.

Affected Products

Imagination Technologies GPU DDK (Driver Development Kit)
Devices integrating PowerVR and Imagination GPU drivers
Consult the Imagination Technologies Driver Vulnerabilities advisory for specific driver versions

Discovery Timeline

2026-07-24 - CVE-2026-49743 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-49743

Vulnerability Analysis

The vulnerability resides in the GPU driver's handling of synchronisation fences during workload submission. Fences are kernel primitives used to signal completion of asynchronous GPU work between userspace clients and the kernel driver. When a fence is exported for cross-process or cross-subsystem sharing, the driver must increment the reference count of the underlying synchronisation primitive to keep it alive for the fence's lifetime.

In the affected code path, the reference count is not incremented correctly during submission. This creates an imbalance between fence lifetime and primitive lifetime. Once the exported fence is destroyed, the underlying primitive is released even though other kernel structures may still hold pointers to it. Subsequent operations dereference freed memory, producing a classic use-after-free condition with both read and write access from kernel context.

Root Cause

The root cause is a missing reference count increment on the synchronisation primitive when a driver-exported fence is bound to a submitted workload. Because ownership semantics assume the primitive outlives the fence, releasing the fence deallocates the primitive prematurely.

Attack Vector

Exploitation requires local code execution as a non-privileged user with access to the GPU device node. The attacker submits crafted GPU workloads that export fences, then triggers destruction of the exported fence to free the underlying primitive. The attacker races or reuses the stale kernel allocation to control freed memory contents, achieving arbitrary kernel read/write. Refer to the Imagination Technologies advisory for exploitation details.

Detection Methods for CVE-2026-49743

Indicators of Compromise

Unexpected kernel panics or oops entries referencing GPU driver symbols related to fence or sync object handling
Unprivileged processes issuing high-frequency ioctl calls to the GPU device node combined with fence export operations
Kernel memory corruption traces originating from GPU workload submission paths

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for driver assertions, KASAN reports, or slab corruption warnings tied to GPU sync primitives
Baseline normal GPU ioctl usage per process and flag anomalous fence export and destroy sequences from unprivileged UIDs
Correlate crashes in GPU driver modules with subsequent privilege escalation attempts on the same host

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) builds in test environments to surface UAF conditions in the GPU driver
Ingest kernel telemetry into a centralized data lake to detect patterns of driver instability across a device fleet
Track process access to /dev/dri/* and vendor-specific GPU device nodes from unexpected binaries or containers

How to Mitigate CVE-2026-49743

Immediate Actions Required

Inventory devices and systems that ship the affected Imagination Technologies GPU driver
Apply vendor-supplied driver updates as soon as they become available for the target platform or SoC
Restrict access to GPU device nodes so only trusted user sessions can issue GPU ioctl calls

Patch Information

Imagination Technologies has published driver updates through its GPU Driver Vulnerabilities advisory. Downstream vendors (SoC integrators, OEMs, and Linux distributions) must integrate the fixed driver revision into their firmware or kernel packages before end users receive the fix.

Workarounds

Limit access to GPU device files using strict Unix permissions and mandatory access control policies such as SELinux or AppArmor
Prevent untrusted code execution paths (including unsandboxed WebGL, containers, or third-party applications) on devices that cannot yet be patched
Disable GPU acceleration for untrusted workloads where operationally feasible until the fixed driver is deployed

bash

# Configuration example: restrict GPU device access to a trusted group
sudo groupadd gpu-trusted
sudo chown root:gpu-trusted /dev/dri/renderD*
sudo chmod 660 /dev/dri/renderD*
# Add only vetted users to the gpu-trusted group
sudo usermod -aG gpu-trusted <trusted-user>