CVE-2026-15466

A vulnerability exists in the GPU DDK where a non-privileged user can make improper GPU system calls to trigger a race condition in the hardware performance counters buffer's destruction path. This issue is caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM(), specifically leadi...

CVE-2026-15466 GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-22166: Use After Free

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the...

CVE-2026-22165: Use After Free

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the...

MiracleLinux 7 : kernel-3.10.0-1160.119.1.0.12.el7.AXS7 (AXSA:2025-10504:42)

"The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10504:42 advisory. pfifotailenqueue: Drop new packet when sch-limit == 0 CVE-2025-21702 xfs: add bounds checking to xlogrecoverprocessdata CVE-2024-41014 netfilter:...