Skip to contentImagination Technologies vulnerabilities
Newest
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMRCVE-2025-58410Fix available7.5 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misusedCVE-2025-46711Fix available5.5 Medium
- imagination technologies graphics ddkGPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAFCVE-2025-25177Fix available5.1 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leakCVE-2025-467097.5 High
- imagination technologies graphics ddkGPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/OverwriteCVE-2025-6573Fix available9.8 Critical
- imagination technologies graphics ddkGPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operationCVE-2025-8109Fix available8.8 High
- imagination technologies graphics ddkGPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelistCVE-2025-25180Fix available7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMsCVE-2025-46708Fix available4.3 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Guest VM can override its own FW VZ connection state after the FW has close itCVE-2025-46707Fix available5.2 Medium
- imagination technologies graphics ddk, imaginationtech ddk +1 morePossible kernel exceptions caused by reading and writing kernel heap data after free.CVE-2025-46710Fix available5.7 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memoryCVE-2025-25179Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)CVE-2024-47893Fix available6.5 Medium
- imagination technologies graphics ddkGPU DDK - Improper locking when accessing the pvr_exp_fence objectCVE-2025-1706Fix available7.5 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - rgxfw_hwperf_get_packet_buffer OOB writeCVE-2025-0467Fix available8.2 High
- imagination technologies graphics ddkGPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memoryCVE-2025-25178Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)CVE-2025-0468Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange failsCVE-2025-0835Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM objectCVE-2025-0478Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary sizeCVE-2024-12837Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned addressCVE-2024-12576Fix available5.5 Medium
- imagination technologies graphics ddkGPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSetCVE-2024-12577Fix available7.3 High
- imagination technologies graphics ddkGPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB writeCVE-2024-52939Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndexCVE-2024-47896Fix available3.3 Low
- imagination technologies graphics ddkGPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mappingCVE-2024-46975Fix available7.9 High
- imagination technologies graphics ddkGPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writesCVE-2024-47900Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - PVRSRVDeviceServicesOpen use-after-free conditionCVE-2024-47899Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - PVRSRVDeviceSyncOpen use-after-free conditionCVE-2024-47898Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race conditionCVE-2024-47891Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - Arbitrary write of read-only dmabufCVE-2024-46974Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB writeCVE-2024-52938Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStoreCVE-2024-52937Fix available6.7 Medium
- imagination technologies graphics ddkGPU DDK - rgxfw_hwperf_config OOB read & writeCVE-2024-52936Fix available4.4 Medium
- imagination technologies graphics ddkGPU DDK - psContext->eDM gives OOB writeCVE-2024-52935Fix available4.1 Medium
- imagination technologies graphics ddkGPU DDK - OOB read into fwlog due to unchecked block countCVE-2024-47895Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - Out of bounds read into fwlog due to unchecked loop boundsCVE-2024-47894Fix available7.1 High
- imagination technologies graphics ddkGPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB writeCVE-2024-47897Fix available8.8 High
- imagination technologies graphics ddkGPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)CVE-2024-43705Fix available7.8 High
- imagination technologies graphics ddkExploitable kernel use-after-free on psServerMMUContext due to reference count mismanagementCVE-2024-46973Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fenceCVE-2024-46972Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA)CVE-2024-47892Fix available7.8 High
- imagination technologies graphics ddkGPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systemsCVE-2024-469717.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAFCVE-2024-43703Fix available8.1 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pagesCVE-2024-43702Fix available8.1 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reusedCVE-2024-43704Fix available8.4 High
- imagination technologies graphics ddkGPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devicesCVE-2024-43701Fix available7.8 High