CVE-2026-16280

Received Received - Intake

Integer Overflow in GPU MMU for Sparse PMRs

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: imaginationtech

Description

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-07-24

Generated

2026-07-25

AI Q&A

2026-07-25

EPSS Evaluated

N/A

NVD

CVE-2026-16280

EUVD

EUVD-2026-48746

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability involves an integer overflow when calculating physical offsets for sparse PMRs (protected memory regions). When PMRs exceed 4 GB, 32-bit address computations may truncate, causing incorrect GPU MMU (memory management unit) mappings. This could let a non-privileged user access unintended physical memory, leading to memory corruption or information disclosure.

Detection Guidance

This vulnerability involves GPU MMU mapping issues due to integer overflow in physical offset calculations for sparse PMRs. Detection requires checking GPU driver logs for memory mapping errors or unexpected physical memory access. No specific commands are provided in the context.

Impact Analysis

A non-privileged user could exploit this to corrupt memory or disclose sensitive information by triggering unintended physical memory access. This may affect system stability, data integrity, or confidentiality, depending on the system's use of GPU memory.

Compliance Impact

This vulnerability may lead to memory corruption or information disclosure, which could result in unauthorized access to sensitive data. Such risks could potentially violate data protection requirements under GDPR or HIPAA if exploited.

Mitigation Strategies

Immediate mitigation steps include updating GPU drivers to the latest version, disabling sparse PMRs if possible, and restricting non-privileged user access to GPU resources. Monitor vendor advisories for patches.

Hi! I’m here to help you understand CVE-2026-16280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70