CVE-2026-41155

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocations in the kernel module. Additionally, an attacker could disrupt the operation of another secure GPU process leading to image corruption / GPU hardware recovery.

Sharing secure memory allocations among various GPU secure processes allows an attacker to corrupt shared resource affecting other users.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-411567.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a wriCVE-2026-411579.8A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU useCVE-2026-411587.8Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical memCVE-2026-411595.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, MermaiCVE-2026-41167.2Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/CCVE-2026-411604.3EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspCVE-2026-411615.3Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/autCVE-2026-411637.0bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mCVE-2026-411644.4nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (CVE-2026-411667.0OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can caCVE-2026-411679.1Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL querCVE-2026-411685.3pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft
CVE-2026-41155: Medium severity, CVSS 5.5 | Vulnix