CVE-2026-65587

GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change

A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an intended memory offset. Writing outside the bounds of allocated memory can corrupt adjacent memory, crash the process, or cause undefined behaviour.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-15466

GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-19199

GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-65584

GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo

Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash. The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-65586

GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-74912

GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB

On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s range 0GB - 4GB, produces error and limits the functionality of the kernel mode driver.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-74915

GPU DDK - OOB write in UntwiddlePOTSquare64bpp

A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-18629

GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges this could lead to crashes or enable further exploits on the device. The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow. The overflow can cause incorrect memory size calculations, leading to memory allocation failures and subsequent invalid program behaviour. Integer overflow can produce unexpected values that affect memory allocation and other security-relevant operations.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-49743

GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more

CVE-2026-49744

GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more

CVE-2026-49745

GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more

CVE-2026-45202

GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free event.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-45200

GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-45197

GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-45201

GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB read and/or write due to improper validation of the said value. Such crafted log2 page size could lead to 4K pages being treated as higher order pages and allowing read and/or write access to the memory beyond 4K threshold.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-45199

GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-16280

GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more

CVE-2026-34193

GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more

CVE-2026-34196

GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping The second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more

CVE-2026-41154

GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Imaginationtech Linux

Products

Android Ddk Graphics Ddk and 1 more