Imaginationtech Ddk vulnerabilities

• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset CVE-2026-16280 Fix available 9.8 CriticalJuly 24, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 CVE-2026-49745 Fix available 7.8 HighJuly 24, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() CVE-2026-49744 Fix available 7.8 HighJuly 24, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed CVE-2026-49743 Fix available 7.8 HighJuly 24, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU CVE-2026-45203 Fix available 7.8 HighJuly 10, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel CVE-2026-45196 Fix available 7.8 HighJuly 10, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Page UAF read in PMMETA_PROTECT heap memory CVE-2026-7639 Fix available 7.8 HighJuly 10, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse CVE-2026-41154 7.8 HighJuly 10, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem CVE-2026-34196 Fix available 7.8 HighJuly 10, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted CVE-2026-45195 Fix available 7.8 HighJune 26, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation CVE-2026-21734 Fix available 7.7 HighJune 26, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() CVE-2026-34193 Fix available 4.3 MediumJune 1, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable CVE-2026-22166 Fix available 8.1 HighMay 1, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs CVE-2026-22165 Fix available 8.1 HighMay 1, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory CVE-2026-22167 Fix available 7.8 HighMay 1, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) CVE-2026-21733 Fix available 7.3 HighApril 17, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU CVE-2026-22163 Fix available 7.8 HighMarch 20, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation CVE-2026-21732 Fix available 9.6 CriticalMarch 20, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled CVE-2026-21736 Fix available 4.4 MediumMarch 9, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP CVE-2025-13952 Fix available 9.8 CriticalJanuary 24, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns CVE-2025-10865 Fix available 7.8 HighJanuary 13, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF CVE-2025-58411 Fix available 8.8 HighJanuary 13, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory CVE-2025-58409 Fix available 3.5 LowJanuary 13, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world CVE-2025-25176 9.1 CriticalJanuary 13, 2026
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code CVE-2025-58408 Fix available 5.9 MediumDecember 1, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet CVE-2025-58407 Fix available 7.4 HighNovember 17, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR CVE-2025-58410 Fix available 7.5 HighNovember 17, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused CVE-2025-46711 Fix available 5.5 MediumSeptember 22, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak CVE-2025-46709 7.5 HighAugust 8, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs CVE-2025-46708 Fix available 4.3 MediumJune 27, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it CVE-2025-46707 Fix available 5.2 MediumJune 27, 2025
• imagination technologies graphics ddk, imaginationtech ddk +1 more Possible kernel exceptions caused by reading and writing kernel heap data after free. CVE-2025-46710 Fix available 5.7 MediumJune 16, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory CVE-2025-25179 Fix available 7.8 HighJune 2, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write CVE-2025-0467 Fix available 8.2 HighApril 18, 2025
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF CVE-2024-43703 Fix available 8.1 HighNovember 30, 2024
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages CVE-2024-43702 Fix available 8.1 HighNovember 30, 2024
• imaginationtech ddk, imagination technologies graphics ddk +1 more GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused CVE-2024-43704 Fix available 8.4 HighNovember 18, 2024
• imagination technologies graphics ddk GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices CVE-2024-43701 Fix available 7.8 HighOctober 14, 2024
• google android, imaginationtech ddk +1 more N/A CVE-2024-31336 Fix available 7.8 HighSeptember 1, 2024
• google android, imaginationtech ddk +1 more In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race... CVE-2024-23716 Fix available 7.0 HighSeptember 1, 2024
• amd athlon 3000g firmware, instinct mi100 firmware, instinct mi210 firmware +129 more +131 more GPU kernel implementations susceptible to memory leak CVE-2023-4969 Fix available 6.5 MediumJanuary 16, 2024