EUVD-2026-38001
GHSA-q7pr-p3c5-mgvj
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Local GPU syscall from an unprivileged but authenticated local user (PR:L), low complexity, no UI; kernel UAF yields high integrity/availability, no direct confidentiality impact stated.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables.
The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.
AnalysisAI
Local privilege escalation and denial of service in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows non-privileged users to trigger a use-after-free of GPU MMU page tables via crafted GPU system calls. An error path fails to clean up before freeing the physical page-table allocation, enabling memory corruption that can be leveraged for kernel-context impact. No public exploit identified at time of analysis and SSVC reports no observed exploitation.
Technical ContextAI
Imagination Technologies' Graphics DDK is the kernel-mode driver stack shipped with PowerVR-class GPUs found in many embedded SoCs, Android handsets, automotive infotainment, and IoT devices. The flaw is a CWE-416 Use-After-Free in the GPU memory management unit (MMU) page-table handling: the driver's error path releases the physical memory backing GPU page tables without first detaching dangling references, leaving freed pages reachable through still-mapped GPU MMU structures. Because GPU page tables are shared kernel structures that direct DMA-capable hardware, dangling references can be reused by the attacker's process and then accessed by the GPU, yielding kernel/DMA-level memory corruption rather than a pure userland fault.
RemediationAI
Patch available per vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; no fixed Graphics DDK version was published in the available data, so administrators should consult Imagination Technologies directly and confirm with their SoC/device OEM which downstream driver release incorporates the fix (track also vuldb.com/vuln/372347 and EUVD-2026-38001). Where patching is blocked by OEM release cycles, compensating controls include restricting which local users and apps may open the PowerVR device nodes (e.g., tighten permissions on /dev/pvr* or equivalent and use SELinux/AppArmor policies to deny GPU ioctl access to untrusted processes), disabling untrusted third-party code execution on the device, and on Android using seccomp filters to block GPU syscall surfaces for low-trust apps - with the trade-off that hardware-accelerated graphics and compute will be degraded or unavailable for those processes. Avoid exposing GPU compute to untrusted tenants on shared embedded systems until the driver is updated.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today