{"id":"CVE-2026-20559","kind":"vulnerability","aliases":["CVE-2026-20559"],"related":[],"title":"GPU pdma driver: use-after-free allows local privilege escalation to higher rights","description":"In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545.","summary":"A use-after-free flaw in the GPU pdma driver can corrupt memory. A local user with ordinary app-level execution can use it to escalate privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","gpu-driver","infrastructure","mobile-soc"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:33+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","triaged_at":"2026-11-02T03:32:33+00:00","updated_at":"2026-11-02T03:32:33+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T03:32:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GPU pdma driver: use-after-free allows local privilege escalation to higher rights","impact":"high","summary":"A use-after-free flaw in the GPU pdma driver can corrupt memory. A local user with ordinary app-level execution can use it to escalate privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["gpu-driver","mobile-soc","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Local app code gains elevated privileges on the device","analyst_note":"Find the vendor bulletin for patch ID ALPS11365081 / issue MSV-9545 to identify affected chipsets and fixed versions.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources name only a GPU pdma driver and a vendor patch ID (ALPS11365081); they do not name the affected devices or versions. Teams running devices with this GPU driver should look for the vendor's bulletin. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":4091,"output_tokens":425,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-20559':17A,20A '-9545':98C 'allow':8A 'alps11365081':94C 'android':21B 'app':49B 'app-level':48B 'corrupt':41B,66C 'could':73C 'cve':15A,18A 'driver':3A,24B,39B 'due':67C 'escal':11A,56B,77C 'execut':51B,82C 'exploit':91C 'flaw':34B 'free':7A,33B,71C 'gpu':1A,23B,37B,59C 'gpu-driv':22B 'higher':13A 'id':93C,96C 'infrastructur':25B 'interact':86C 'issu':95C 'lead':74C 'level':50B 'local':9A,44B,76C 'memori':42B,65C 'mobil':27B 'mobile-soc':26B 'msv':97C 'need':84C,89C 'ordinari':47B 'patch':92C 'pdma':2A,38B,60C 'possibl':64C 'privileg':10A,57B,79C,83C 'right':14A 'soc':28B 'use':5A,31B,53B,69C 'use-after-fre':4A,30B 'user':45B,81C,85C","nicknames":[],"mitigations":[],"who_affected":"The sources name only a GPU pdma driver and a vendor patch ID (ALPS11365081); they do not name the affected devices or versions. Teams running devices with this GPU driver should look for the vendor's bulletin. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","gpudriver","infrastructure","mobilesoc","unknown"],"first_public_at":"2026-11-02T03:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20559","severity":null,"published_at":"2026-11-02T03:17:33+00:00","modified_at":"2026-11-02T03:17:33+00:00","first_seen_at":"2026-11-02T03:31:24+00:00","fetched_at":"2026-11-02T03:31:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}