GPU Driver Kernel Memory Safety Vulnerabilities

Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Environment (REE) kernel control to corrupt GPU Firmware data across the TEE security boundary. The GPU Firmware blindly dereferences a pointer sourced from non-secure memory when moving internal data between tightly coupled private memory and main memory - a trust boundary violation that undermines the fundamental isolation guarantee of Trusted Execution Environment platforms. No active exploitation has been confirmed (CISA KEV absent), and EPSS sits at 0.15% (5th percentile), but the cross-domain nature of this flaw makes it relevant for embedded, mobile, and automotive threat models where TEE integrity is a security anchor.

Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.

Kernel null pointer dereference in Imagination Technologies Graphics DDK allows a local non-privileged user to crash the host system via crafted GPU system calls. Multiple release branches are affected, including DDK 26.1 RTM1, 25.1-25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. An attacker with a local shell account on a device running the affected kernel driver can trigger platform instability or a full denial of service - no exploit has been publicly identified at time of analysis, and EPSS probability is extremely low at 0.15% (5th percentile).