Skip to contentImagination Technologies Graphics Ddk vulnerabilities
- imagination technologies graphics ddkSoftware installed and run as a non-privileged user may conduct improper GPU system calls to the...CVE-2026-74911No score
- imagination technologies graphics ddkGPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommonCVE-2026-49747No score
- imagination technologies graphics ddkGPU DDK - Write UAF in OSDebugSignalPID due to incorrect management of PID resourcesCVE-2026-15465No score
- imagination technologies graphics ddkGPU DDK - OOB write in UntwiddlePOTSquare64bppCVE-2026-749158.8 High
- imagination technologies graphics ddkGPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GBCVE-2026-74912Fix available9.8 Critical
- imagination technologies graphics ddkGPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSetCVE-2026-19199Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilationCVE-2026-18629Fix available7.5 High
- imagination technologies graphics ddkGPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL changeCVE-2026-65587Fix available5.5 Medium
- imagination technologies graphics ddkGPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKMCVE-2026-65586Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfoCVE-2026-655847.8 High
- imagination technologies graphics ddkGPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()CVE-2026-15466Fix available7.0 High
- imagination technologies graphics ddkGPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlagsCVE-2026-45200Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSetCVE-2026-45197Fix available2.5 Low
- imagination technologies graphics ddkGPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`CVE-2026-45202Fix available5.5 Medium
- imagination technologies graphics ddkGPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memoryCVE-2026-45201Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - rgxfw_to_ptr() does not reject FW private data pointersCVE-2026-45199Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMemCVE-2026-49746Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memoryCVE-2026-45204Fix available5.5 Medium
- imagination technologies graphics ddkGPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrustedCVE-2026-45198Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffsetCVE-2026-16280Fix available9.8 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0CVE-2026-49745Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()CVE-2026-49744Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closedCVE-2026-49743Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOUCVE-2026-45203Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernelCVE-2026-45196Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Page UAF read in PMMETA_PROTECT heap memoryCVE-2026-7639Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_SparseCVE-2026-411547.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMemCVE-2026-34196Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrustedCVE-2026-45195Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilationCVE-2026-21734Fix available7.7 High
- imagination technologies graphics ddkGPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding referenceCVE-2026-41156Fix available7.7 High
- imagination technologies graphics ddkGPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entriesCVE-2026-34192Fix available7.7 High
- imagination technologies graphics ddkGPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrinkCVE-2026-41158Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3DCVE-2026-41157Fix available9.8 Critical
- imagination technologies graphics ddkGPU DDK - SharedSecMem mapped into all GPU virtual address spacesCVE-2026-41155Fix available5.5 Medium
- imagination technologies graphics ddkGPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexesCVE-2026-34195Fix available8.8 High
- imagination technologies graphics ddkGPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index countCVE-2026-34194Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogicalCVE-2026-22164Fix available7.5 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()CVE-2026-34193Fix available4.3 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachableCVE-2026-22166Fix available8.1 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBsCVE-2026-22165Fix available8.1 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memoryCVE-2026-22167Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)CVE-2026-21733Fix available7.3 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPUCVE-2026-22163Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilationCVE-2026-21732Fix available9.6 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabledCVE-2026-21736Fix available4.4 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBPCVE-2025-13952Fix available9.8 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - DevmemIntGetReservationData does not ref the PMR it returnsCVE-2025-10865Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAFCVE-2025-58411Fix available8.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memoryCVE-2025-58409Fix available3.5 Low
- Show olderLoading…