CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in...

CVE-2026-16280

The GPU DDK is vulnerable to an integer overflow within the _PMRLogicalOffsetToPhysicalOffset function when calculating physical offsets for sparse PMRs . For PMRs exceeding 4 GB , this overflow causes 32-bit truncation of address computations, leading to incorrect GPU MMU mappings . A non-privil...

CVE-2026-0152

In OSMMapPMRGeneric of pmros.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

MINI-GWMP-5QMR-PMR3

Bulletin has no description...

CVE-2025-10865 GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for use after free was present...

EUVD-2024-54967

Malicious code in bioql PyPI...

CVE-2024-49739

A security vulnerability exists in Google Android involving an out-of-bounds write within the MMapVAccess function of pmr_os.c . This flaw stems from improper input validation and allows a local attacker to achieve local escalation of privilege without requiring additional execution privileges or...

PT-2025-36008

Name of the Vulnerable Software and Affected Versions: pmr os.c affected versions not specified Description: An out-of-bounds write issue exists in the MMapVAccess function within pmr os.c due to insufficient input validation. Successful exploitation of this issue could lead to local privilege...

CVE-2023-21263

In OSMMapPMRGeneric of pmros.c, there is a possible out of bounds write due to an uncaught exception. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21163

In PMRReadBytes of pmr.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21217

In PMRWritePMPageList of TBD, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-46997

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GICPRIOPSRISET during entry Zenghui reports that booting a kernel with "irqchip.gicv3pseudonmi=1" on the command line hits a warning during kernel entry, due to the way we manipulate the PMR. Early in the...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GICPRIOPSRISET during entry Zenghui reports that booting a kernel with "irqchip.gicv3pseudonmi=1" on the command line hits a warning during kernel entry, due to the way we manipulate the PMR. Early in the...

CVE-2021-46997 arm64: entry: always set GIC_PRIO_PSR_I_SET during entry

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GICPRIOPSRISET during entry Zenghui reports that booting a kernel with "irqchip.gicv3pseudonmi=1" on the command line hits a warning during kernel entry, due to the way we manipulate the PMR. Early in the...

The vulnerability of the OSMMapPMRGeneric function (pmr_os.c) in the Android operating system allows a hacker to increase their privileges.

The vulnerability of the OSMMapPMRGeneric function pmros.c in the Android operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

PT-2023-8468 · Unknown · Powervr Gpu Driver

Name of the Vulnerable Software and Affected Versions: PowerVR GPU driver versions affected versions not specified Description: The issue is related to a buffer overflow in the PowerVR GPU driver, specifically in the PMR ReadBytes function for Android and ChromeOS, and an out of bounds write in t...

CVE-2021-0945

In PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via PhysmemNewRamBackedPMR. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-9134 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android SoC Description: The issue arises from the method PVRSRVBridgePMRPDumpSymbolicAddr, which allocates a buffer on the heap, attempts to fill it via PMR PDumpSymbolicAddr, and then copies the buffer to userspace. If PMR...

pmr-avtorinok.ru Cross Site Scripting vulnerability OBB-1280514

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

pmr.szczecin.pl Cross Site Scripting vulnerability OBB-1266523

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...