Live › vulnerability › CVE-2026-19199
A 32-bit integer overflow in the KM GPU driver's page-to-byte conversion can produce an undersized kernel buffer. A non-privileged local process can then map physical pages it should not reach into a GPU memory context and read sensitive kernel data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 02:28 UTC. All times on this page are UTC.
Affects systems where software runs as a non-privileged user and can issue the affected GPU driver's memory allocation calls. The sources do not name the affected driver vendor, product or versions, so it is unknown whether a given machine runs the vulnerable KM driver. Systems without that driver, or without untrusted local users or processes, are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.
This page as .md · .json · in your agent: get_signal("CVE-2026-19199")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.