{"id":"CVE-2026-19199","kind":"vulnerability","aliases":["CVE-2026-19199"],"related":[],"title":"GPU kernel driver: integer overflow lets local users read kernel memory","description":"Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.","summary":"A 32-bit integer overflow in the KM GPU driver's page-to-byte conversion can produce an undersized kernel buffer. A non-privileged local process can then map physical pages it should not reach into a GPU memory context and read sensitive kernel data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpu-driver","infrastructure","linux-kernel","multi-user"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T02:17:09+00:00","first_seen_at":"2026-10-30T02:28:06+00:00","triaged_at":"2026-10-30T02:30:14+00:00","updated_at":"2026-10-30T02:30:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-30T02:30:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GPU kernel driver: integer overflow lets local users read kernel memory","impact":"medium","summary":"A 32-bit integer overflow in the KM GPU driver's page-to-byte conversion can produce an undersized kernel buffer. A non-privileged local process can then map physical pages it should not reach into a GPU memory context and read sensitive kernel data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["gpu-driver","linux-kernel","multi-user"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local process reads sensitive kernel memory through GPU mappings","analyst_note":"Identify the vendor and product of the KM driver and its affected and fixed versions from the NVD entry and the vendor advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Affects systems where software runs as a non-privileged user and can issue the affected GPU driver's memory allocation calls. The sources do not name the affected driver vendor, product or versions, so it is unknown whether a given machine runs the vulnerable KM driver. Systems without that driver, or without untrusted local users or processes, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":4150,"output_tokens":501,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19199':14A,17A '-2026':13A,16A '32':29B,95C 'alloc':91C,111C,120C,127C 'allow':123C 'attack':136C 'attacker-control':135C 'bit':30B,96C 'buffer':49B,119C 'byte':42B,107C 'call':89C 'conduct':86C 'context':69B,140C 'control':137C 'convers':43B,108C 'cve':12A,15A 'data':74B,147C 'disclosur':143C 'driver':3A,20B,37B,102C 'gpu':1A,19B,36B,67B,138C 'gpu-driv':18B 'improp':87C 'infrastructur':21B 'instal':76C 'integ':4A,31B,97C 'kernel':2A,10A,24B,48B,73B,118C,146C 'km':35B,101C 'lead':141C 'let':6A 'linux':23B 'linux-kernel':22B 'local':7A,54B 'map':58B,132C 'may':85C,122C 'memori':11A,68B,93C 'mmu':139C 'multi':26B 'multi-us':25B 'non':52B,82C 'non-privileg':51B,81C 'overflow':5A,32B,98C 'page':40B,60B,105C,129C 'page-to-byt':39B,104C 'physic':59B,92C,128C 'previous':126C 'privileg':53B,83C 'process':55B 'produc':45B 'reach':64B 'read':9A,71B 'result':114C 'run':78C 'sensit':72B,145C 'size':112C 'softwar':75C 'system':88C 'unalloc':124C 'unders':47B,117C 'user':8A,27B,84C","nicknames":[],"mitigations":[],"who_affected":"Affects systems where software runs as a non-privileged user and can issue the affected GPU driver's memory allocation calls. The sources do not name the affected driver vendor, product or versions, so it is unknown whether a given machine runs the vulnerable KM driver. Systems without that driver, or without untrusted local users or processes, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T02:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19199","severity":null,"published_at":"2026-10-30T02:17:09+00:00","modified_at":"2026-10-30T02:17:09+00:00","first_seen_at":"2026-10-30T02:28:06+00:00","fetched_at":"2026-10-30T02:28:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}