{"id":"CVE-2026-15466","kind":"vulnerability","aliases":["CVE-2026-15466"],"related":[],"title":"NVIDIA GPU driver: race condition lets local user corrupt kernel memory","description":"Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF.\n\n\n\nThe race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.","summary":"A race condition in the GPU driver's hardware performance counter buffer destruction path can decrement a reference counter non-atomically. This lets other code use a freed object to read and write kernel heap memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpu-driver","infrastructure","linux","multi-user-hosts"],"not_affected_if":["no-gpu","no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T02:17:08+00:00","first_seen_at":"2026-10-30T02:28:05+00:00","triaged_at":"2026-10-30T02:30:15+00:00","updated_at":"2026-10-30T02:30:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-30T02:30:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NVIDIA GPU driver: race condition lets local user corrupt kernel memory","impact":"high","summary":"A race condition in the GPU driver's hardware performance counter buffer destruction path can decrement a reference counter non-atomically. This lets other code use a freed object to read and write kernel heap memory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["gpu-driver","linux","multi-user-hosts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel memory read and write access","analyst_note":"Identify the affected GPU driver product and version ranges and the vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-15466.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-gpu","no-untrusted-local-users"],"who_is_affected":"Any machine running an affected GPU driver where a non-privileged local user can run software that issues GPU system calls. The sources do not name the affected driver versions or products. Systems without GPUs or with no untrusted local users are likely less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":4131,"output_tokens":481,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15466':14A,17A '-2026':13A,16A 'allow':117C 'and/or':95C,127C 'atom':48B,115C 'buffer':38B,88C 'call':79C 'caus':81C 'code':52B,119C 'condit':5A,29B,83C,100C 'conduct':75C 'corrupt':9A 'could':105C 'counter':37B,45B,87C,109C 'cve':12A,15A 'decrement':42B,111C 'destruct':39B,90C,103C 'driver':3A,20B,33B 'freed':55B,123C 'gpu':2A,19B,32B,77C 'gpu-driv':18B 'hardwar':35B,85C 'heap':62B,130C 'host':26B 'improp':76C 'infrastructur':21B 'instal':65C 'kernel':10A,61B,129C 'lead':92C,106C 'let':6A,50B 'linux':22B 'local':7A 'may':74C 'memori':11A,63B,131C 'multi':24B 'multi-user-host':23B 'non':47B,71C,114C 'non-atom':46B,113C 'non-privileg':70C 'nvidia':1A 'object':56B,124C 'path':40B,91C,104C,120C 'perform':36B,86C 'privileg':72C 'race':4A,28B,82C,99C 'read':58B,94C,126C 'refer':44B,108C 'run':67C 'softwar':64C 'system':78C 'uaf':97C 'use':53B,121C 'user':8A,25B,73C 'way':116C 'write':60B,96C,128C","nicknames":[],"mitigations":[],"who_affected":"Any machine running an affected GPU driver where a non-privileged local user can run software that issues GPU system calls. The sources do not name the affected driver versions or products. Systems without GPUs or with no untrusted local users are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T02:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15466","severity":null,"published_at":"2026-10-30T02:17:08+00:00","modified_at":"2026-10-30T02:17:08+00:00","first_seen_at":"2026-10-30T02:28:05+00:00","fetched_at":"2026-10-30T02:28:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}