CLEANSTART-2026-SG81410 Security fixes for ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 25.10.0-r1

Multiple security vulnerabilities affect the gpu-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-51540

OpENer 2.3.0 master branch up to commit 76b95cf is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages SendUnitData...

PT-2026-59411

Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the translationVectors array when reading the "UNIT CELL TRANSLATION" block of a crafted input file. Details The MOPAC output reader stored translation vectors from the UNIT CELL...

PT-2026-59901

Impact Out of bounds read in GRUBlockCellGrad python func = tf.raw ops.GRUBlockCellGrad para = 'x': 21.1, 156.2, 83.3, 115.4, 'h prev': array136.5, 136.6, 'w ru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'w c': array 0.4, 31.5, 0.6, 'b ru': array0.1, 0.2 , dtype=float32, 'b c': 0x41414141, 'r':...

PT-2026-59742

Impact When running on GPU, tf.image.generate bounding box proposals receives a scores input that must be of rank 4 but is not checked. python import tensorflow as tf a = tf.constantvalue=1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0 b = tf.constantvalue=1 tf.image.generate bounding box...

PT-2026-60017

Summary All temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors tha...

CVE-2026-7639

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-41154

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access...

CVE-2026-45203

A Time-of-check Time-of-use (TOCTOU) race condition exists in the GPU DDK within the rgxfw_hwperf_ufo() function. The vulnerability is caused because the system re-reads psCmdHeader->ui32CmdSize after the initial validation check but before it is used. This allows a malicious driver to modify ...

CVE-2026-45196

The GPU DDK is affected by an arbitrary GPU register write in rgxfw_hwperf_hw. This vulnerability is caused by unsanitized pointers originating from the host kernel, which allows kernel software running inside a Host VM to post improper commands to the GPU Firmware . Successful exploitation of th...

EUVD-2026-43039

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation...

CVE-2026-45196

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation...

EUVD-2026-43037

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-7639

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-41154 GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access...

CVE-2026-41154 GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access...

PyJWT Issuer field partial matches allowed

SummaryThe wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". DetailsThis is a bug introduced in version 2.10.0: checking the "iss" claimchanged from isinstanceissuer, list to isinstanceissuer,Sequence.diff- if isinstanceissuer, list:+ if isinstanceissuer,...

SUSE CVE-2026-13775

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

SUSE CVE-2026-13831

Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-13923

Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...