EUVD-2026-36606
GHSA-2wv8-chjf-q56w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
C:L added over official C:N to reflect vendor-confirmed information-disclosure tag and cross-process data-passing described in the vulnerability; all other metrics align with local low-privilege access and high availability disruption.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocations in the kernel module. Additionally, an attacker could disrupt the operation of another secure GPU process leading to image corruption / GPU hardware recovery.
Sharing secure memory allocations among various GPU secure processes allows an attacker to corrupt shared resource affecting other users.
AnalysisAI
Insufficient compartmentalization in the Imagination Technologies Graphics DDK kernel module enables a local, low-privileged attacker to abuse shared secure GPU memory allocations to either covertly pass data between otherwise isolated secure GPU processes or disrupt a peer process, causing image corruption and GPU hardware recovery events. Multiple DDK release trains spanning versions 1.18 RTM through 26.1 RTM are confirmed affected per EUVD-2026-36606. No public exploit exists and SSVC confirms no observed exploitation, but the 'Information Disclosure' tag in the advisory signals a confidentiality dimension that the official CVSS C:N metric does not fully capture.
Technical ContextAI
CWE-653 (Insufficient Compartmentalization) describes a failure to enforce adequate isolation boundaries between components that should be mutually untrusting. In this case, the Imagination Technologies GPU kernel driver (cpe:2.3:a:imagination_technologies:graphics_ddk:*:*:*:*:*:*:*:*) manages 'secure GPU processes' - workloads expected to run in protected memory regions isolated from peer GPU processes. The kernel module exposes a shared secure memory allocation mechanism that lacks adequate access controls between processes, breaking the principal-of-least-privilege boundary the secure GPU model is designed to enforce. An attacker process sharing the same GPU hardware can manipulate these allocations to read data owned by another secure GPU process (covert channel / information disclosure) or to corrupt the shared resource and force a GPU hardware recovery cycle, causing availability loss for other users of the GPU.
RemediationAI
The primary remediation path is to apply updated Graphics DDK releases provided by Imagination Technologies; consult the vendor GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for patched version identifiers across each affected release train, as exact fix versions were not independently confirmed in the available data (patch availability per vendor advisory only). If immediate patching is not feasible in multi-tenant GPU environments, restrict workload co-tenancy on Imagination GPU hardware so that untrusted processes cannot share the same GPU context as sensitive secure GPU processes - this directly addresses the shared-memory attack surface but may reduce GPU utilization efficiency. Kernel-level access controls (e.g., restricting /dev/dri or equivalent GPU device node access to authorized users only) can limit which processes can allocate secure GPU memory, raising the privilege bar for exploitation.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today