CVE-2026-65584
GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
- Record
CVE-2026-65584- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-05
EUVDEUVD-2026-113477
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
- Record
EUVD-2026-113477- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-6892-6w2m-w923
Software installed and run as a non-privileged user may conduct improper GPU system calls causing...
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
- Record
GHSA-6892-6w2m-w923- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-06
NVD
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
- Record
CVE-2026-65584- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, severity | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-65584 is a high vulnerability (CVSS 7.8) in Imagination Technologies Graphics Ddk, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. No source names a fixed version.