EUVD-2026-36630
GHSA-xvxw-65r3-5rcf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attacker with any unprivileged account can reliably trigger a kernel UAF via GPU syscalls, yielding full kernel read/write and thus high C/I/A with no user interaction.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages.
Physical memory allocated and freed, without the deferred free mechanism can lead to those resources being used for read/write by the GPU after the kernel module has freed the resource.
AnalysisAI
Local privilege escalation in Imagination Technologies Graphics DDK (GPU kernel driver) allows non-privileged users to issue crafted GPU system calls that perform read/write operations on arbitrary freed physical memory pages, enabling kernel memory corruption. The flaw stems from missing deferred-free handling, meaning the GPU can still access pages after the kernel module has released them. No public exploit identified at time of analysis and EPSS is very low (0.02%), but CVSS 7.8 reflects high local impact on confidentiality, integrity, and availability.
Technical ContextAI
Imagination Technologies' Graphics DDK is the kernel-mode driver and userspace stack powering PowerVR/IMG GPUs found in many Android devices, embedded SoCs, and automotive platforms. The driver exposes ioctl/system-call interfaces that let userspace processes program the GPU's memory management. The root cause is CWE-416 (Use After Free): physical pages are allocated for GPU use and freed back to the kernel without going through a deferred-free path that would ensure the GPU's MMU/page tables no longer reference them. Because the GPU can continue to DMA against those physical addresses after the kernel reuses them for unrelated allocations, an unprivileged process controlling GPU jobs gains an arbitrary physical read/write primitive against kernel memory.
RemediationAI
Upstream fix available per Imagination's GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; a specific patched DDK release version is not independently confirmed from the provided data, so administrators should consult that advisory and their SoC/OEM (e.g., MediaTek, Renesas, automotive Tier 1, or handset vendor) for the corresponding firmware/OS update that integrates the fixed DDK. For fleets that cannot patch immediately, the most effective compensating control is to restrict installation of untrusted local applications on affected devices - e.g., enforce managed app stores and disable sideloading on Android, since the bug requires local code execution to issue GPU system calls; this trades off user/developer flexibility. Where supported, SELinux/MAC profiles that deny GPU device node access (e.g., /dev/pvr* or equivalent render node) to untrusted_app domains can reduce attack surface, but will break any application that legitimately uses GPU compute or accelerated rendering, so test carefully before broad rollout.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today