EUVD-2026-38002
GHSA-fpwh-r7hr-w6hc
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Local unprivileged user must access GPU device nodes (PR:L) and win a CPU/GPU race (AC:H); kernel memory corruption yields high integrity and availability impact, no direct confidentiality loss.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario.
A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing it.
AnalysisAI
Local privilege escalation and denial of service in Imagination Technologies Graphics DDK arises from a write use-after-free between the CPU-side driver and GPU firmware, where the driver frees a shared memory page before the GPU firmware finishes accessing it. Any unprivileged local user able to issue GPU system calls can trigger the race against multiple released DDK branches (1.18, 23.2, 24.2, 25.1-25.3, 26.1). No public exploit identified at time of analysis, but SSVC rates technical impact as total.
Technical ContextAI
The Imagination Graphics DDK is the Direct Device Kernel driver stack that powers PowerVR/IMG GPUs found in many mobile SoCs, embedded systems, and some automotive/IoT platforms. The flaw is a classic CWE-416 use-after-free, but the lifetime mismanagement crosses an execution boundary: a memory page is owned by the CPU-side kernel driver yet referenced concurrently by GPU firmware running on the GPU's own microcontroller. Because the CPU thread frees the page while the GPU firmware still holds and writes to it, subsequent reallocation lets attacker-controlled data be written into reused kernel-managed memory, a common primitive for kernel privilege escalation when triggered from a userspace process via ioctl-style GPU syscalls.
RemediationAI
Patch available per vendor advisory - consult Imagination's GPU driver vulnerabilities page at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the fixed DDK revision corresponding to each affected branch (1.18, 23.2, 24.2, 25.1-25.3, 26.1) and coordinate with your SoC vendor or device OEM, since DDK updates typically ship via platform BSPs rather than direct end-user installs. Until a vendor-released patched DDK is deployed, compensating controls are limited because GPU device nodes are normally accessible to all local users; consider restricting access to the PowerVR/IMG render and control device nodes (e.g., /dev/dri/* or vendor-specific /dev/pvr* equivalents) to a trusted GPU group, accepting that this breaks graphics for non-trusted users, and on multi-tenant or kiosk devices avoid running untrusted code locally. Monitor kernel logs for GPU firmware faults or driver oops traces that may indicate exploitation attempts; see also https://vuldb.com/vuln/372345 for tracking.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today