CVE-2026-49743

A Use-After-Free (UAF) vulnerability exists in the GPU DDK because the GPU driver fails to properly increment the reference count of an underlying synchronisation primitive during workload submission involving an exported fence. A non-privileged user can exploit this by destroying the exported fe...

CVE-2025-13952

The Imagination Graphics DDK contains a write use-after-free vulnerability within the GPU shader compiler library (libusc ). This issue occurs when a web page containing unusual GPU shader code is loaded from the internet into the GPU compiler process. Specifically, the shader code triggers a pat...

CVE-2026-34193

The Imagination Graphics DDK is affected by a vulnerability where a logic error in the address translation allows kernel software running inside a Guest or Host VM to post improper commands to the GPU Firmware . This flaw, specifically involving insufficient pointer validation in rgxfw_to_ptr(), ...

CVE-2026-49745

Kernel software running within a Guest VM can exploit a vulnerability in the GPU DDK to send improper commands to the GPU Firmware . Specifically, an unvalidated sHWPerfCtlDMABuf GPU-VA allows for a DMA-write into FW privdata via MMU ctx 0 . This root cause results in out-of-bounds memory accesse...

CVE-2026-34196

The GPU DDK is affected by a Use After Free (UAF) vulnerability caused by an integer truncation in PMRDevPhysAddrOSMem . A non-privileged user can execute improper GPU system calls to trigger an integer overflow, resulting in two GPU virtual addresses mapping to the same physical address. By free...

CVE-2026-7639

The GPU DDK is vulnerable to a use after free (UAF) condition in the PMMETA_PROTECT heap memory. A non-privileged user can execute a sequence of improper GPU system calls to trigger a failure path in the MMU mapping logic , resulting in incomplete cleanup of an internal driver state. This allows ...

CVE-2026-16280

The GPU DDK is vulnerable to an integer overflow within the _PMRLogicalOffsetToPhysicalOffset function when calculating physical offsets for sparse PMRs . For PMRs exceeding 4 GB , this overflow causes 32-bit truncation of address computations, leading to incorrect GPU MMU mappings . A non-privil...

CVE-2026-45203

A Time-of-check Time-of-use (TOCTOU) race condition exists in the GPU DDK within the rgxfw_hwperf_ufo() function. The vulnerability is caused because the system re-reads psCmdHeader->ui32CmdSize after the initial validation check but before it is used. This allows a malicious driver to modify ...

CVE-2026-21733

A vulnerability exists in the Imagination Technologies Graphics DDK (Linux and Android) due to improper handling of GPU memory reservation protections . Specifically, incorrect flag validation in RGXDerivePTEProt8 allows software running with non-privileged user privileges to conduct improper GPU...

CVE-2026-45196

The GPU DDK is affected by an arbitrary GPU register write in rgxfw_hwperf_hw. This vulnerability is caused by unsanitized pointers originating from the host kernel, which allows kernel software running inside a Host VM to post improper commands to the GPU Firmware . Successful exploitation of th...

CVE-2025-58409

Software running as a non-privileged user can perform improper GPU system calls to subvert hardware and write to arbitrary physical memory pages . This vulnerability allows an attacker to corrupt data pages not allocated by the GPU driver, including memory used by the kernel and drivers running o...

CVE-2026-41154

The GPU DDK is vulnerable to an out-of-bounds (OOB) memory access issue. The root cause is incorrect buffer indexing within the page freeing logic of the sparse memory implementation specifically when indexing pages larger than 4kB . An attacker running software as a non-privileged user may lever...

CVE-2026-49744

A vulnerability in the GPU DDK allows kernel software running inside a Guest VM to post improper commands to the GPU Firmware . This triggers an out-of-bounds access (specifically an unchecked ui32TracePointer in rgxfw_log_ex()), resulting in a data write outside the Guest's virtualized GPU memor...

CVE-2025-10865

The Imagination Graphics DDK is vulnerable to a flaw where a non-privileged user can conduct improper GPU system calls. This leads to mismanagement of reference counting on an internal resource, potentially resulting in a use after free condition. While the specific function is identified in some...

CVE-2025-58411

A Use After Free (UAF) vulnerability exists in the GPU DDK , specifically within the Reservation::psMappedPMR component. The root cause is improper resource management and reference counting, where a resource can change while being used by a freelist. A non-privileged user can conduct improper GP...

CVE-2025-25176

The Imagination Graphics DDK , a suite of GPU driver tools, contains a security vulnerability where intermediate register values from secure workloads can be exfiltrated. This occurs when workloads are scheduled from applications running in the platform's non-secure environment . This vulnerabili...