Imagination Technologies Graphics DDK
87 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-45197 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet | LOW 2.5 | 0.1 % | ||
| CVE-2026-45200 | 24.2 RTM2 ; 25.1 RTM2 – 25.3 RTM ; 26.1 RTM1 | GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags | HIGH 7.8 | 0.2 % | ||
| CVE-2026-45202 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast` | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-45201 | 24.2 RTM2 ; 25.1 RTM2 – 25.3 RTM ; 26.1 RTM1 | GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory | HIGH 7.8 | 0.2 % | ||
| CVE-2026-45199 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers | HIGH 7.8 | 0.2 % | ||
| CVE-2026-49746 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem | HIGH 7.1 | 0.2 % | ||
| CVE-2026-45204 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-45198 | 1.17 RTM2 ; 1.18 RTM2 ; 23.2 RTM2 ; … | GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted | HIGH 7.8 | 0.2 % | ||
| CVE-2026-16280 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-49745 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 | HIGH 7.8 | 0.2 % | ||
| CVE-2026-49744 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() | HIGH 7.8 | 0.2 % | ||
| CVE-2026-49743 | 24.2 RTM2 ; 25.1 RTM2 – 25.3 RTM ; 26.1 RTM1 | GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed | HIGH 7.8 | 0.2 % | ||
| CVE-2026-45203 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU | HIGH 7.8 | 0.1 % | ||
| CVE-2026-45196 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel | HIGH 7.8 | 0.1 % | ||
| CVE-2026-7639 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - Page UAF read in PMMETA_PROTECT heap memory | HIGH 7.8 | 0.2 % | ||
| CVE-2026-41154 | 24.2 RTM2 ; 25.1 RTM2 – 25.3 RTM ; 26.1 RTM1 | GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse | HIGH 7.8 | 0.2 % | ||
| CVE-2026-34196 | 1.18 RTM2 ; 23.2 RTM2 ; 24.2 RTM2 ; … | GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem | HIGH 7.8 | 0.2 % | ||
| CVE-2026-45195 | 1.18 RTM ; 23.2 RTM ; 24.2 RTM ; … | GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted | HIGH 7.8 | 0.1 % | ||
| CVE-2026-21734 | 1.18 RTM ; 23.2 RTM ; 24.1 RTM – 24.2 RTM ; … | GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation | HIGH 7.7 | 0.2 % | ||
| CVE-2026-41156 | 1.18 RTM ; 23.2 RTM ; 24.2 RTM ; … | GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference | HIGH 7.7 | 0.2 % | ||
| CVE-2026-34192 | 1.18 RTM ; 23.2 RTM ; 24.2 RTM ; … | GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries | HIGH 7.7 | 0.2 % | ||
| CVE-2026-41158 | 25.1 RTM – 25.3 RTM ; 26.1 RTM | GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink | HIGH 7.8 | 0.1 % | ||
| CVE-2026-41157 | 1.18 RTM ; 23.2 RTM ; 24.2 RTM ; … | GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-41155 | 1.18 RTM ; 23.2 RTM ; 24.2 RTM ; … | GPU DDK - SharedSecMem mapped into all GPU virtual address spaces | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-34195 | 24.2 RTM ; 25.1 RTM – 25.3 RTM | GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes | HIGH 8.8 | 0.3 % | ||
| CVE-2026-34194 | 24.2 RTM ; 25.1 RTM – 25.3 RTM ; 26.1 RTM | GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count | HIGH 7.1 | 0.1 % | ||
| CVE-2026-22164 | 24.2 RTM ; 25.1 RTM – 25.3 RTM ; 26.1 RTM | GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical | HIGH 7.5 | 0.3 % | ||
| CVE-2026-34193 | 1.18 RTM ; 23.2 RTM ; 24.2 RTM ; … | GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() | MEDIUM 4.3 | 0.1 % | ||
| CVE-2026-22166 | 1.18 RTM ; 23.2 RTM ; 24.1 RTM – 24.2 RTM ; … | GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable | HIGH 8.1 | 0.4 % | ||
| CVE-2026-22165 | 1.18 RTM ; 23.2 RTM ; 24.1 RTM – 24.2 RTM ; … | GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs | HIGH 8.1 | 0.3 % | ||
| CVE-2026-22167 | 1.18 RTM ; 23.2 RTM ; 24.1 RTM – 24.2 RTM ; … | GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory | HIGH 7.8 | 0.2 % | ||
| CVE-2026-21733 | 1.18 RTM ; 23.2 RTM ; 24.1 RTM – 24.2 RTM ; … | GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) | HIGH 7.3 | 0.1 % | ||
| CVE-2026-22163 | 1.17 RTM ; 1.18 RTM ; 23.2 RTM ; … | GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU | HIGH 7.8 | 0.1 % | ||
| CVE-2026-21732 | 23.2 RTM ; 24.1 RTM – 25.1 RTM | GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-21736 | 1.17 RTM ; 1.18 RTM ; 23.2 RTM ; … | GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled | MEDIUM 4.4 | 0.1 % | ||
| CVE-2025-13952 | 25.1 RTM – 25.2 RTM | GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-10865 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns | HIGH 7.8 | 0.1 % | ||
| CVE-2025-58411 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF | HIGH 8.8 | 0.2 % | ||
| CVE-2025-58409 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory | LOW 3.5 | 0.2 % | ||
| CVE-2025-25176 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-58408 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code | MEDIUM 5.9 | 0.1 % | ||
| CVE-2025-58407 | 25.2 RTM1 | GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet | HIGH 7.4 | 0.2 % | ||
| CVE-2025-58410 | 23.3 RTM – 25.1 RTM2 ; 25.2 RTM | GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR | HIGH 7.5 | 0.3 % | ||
| CVE-2025-46711 | 1.17 RTM ; 1.18 RTM ; 23.2 RTM – 25.1 RTM1 | GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused | MEDIUM 5.5 | 0.1 % | ||
| CVE-2025-25177 | 24.1 RTM – 25.1 RTM2 | GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF | MEDIUM 5.1 | 0.1 % | ||
| CVE-2025-46709 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak | HIGH 7.5 | 0.3 % | ||
| CVE-2025-6573 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite | CRITICAL 9.8 | 0.4 % | ||
| CVE-2025-8109 | 1.13 RTM – 24.2 RTM2 | GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation | HIGH 8.8 | 0.4 % | ||
| CVE-2025-25180 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist | HIGH 7.8 | 0.2 % | ||
| CVE-2025-46708 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-46707 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it | MEDIUM 5.2 | 0.1 % | ||
| CVE-2025-46710 | 1.15 RTM – 24.2 RTM2 | Possible kernel exceptions caused by reading and writing kernel heap data after free. | MEDIUM 5.7 | 0.2 % | ||
| CVE-2025-25179 | 1.15 RTM ; 1.17 RTM ; 1.18 RTM ; … | GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory | HIGH 7.8 | 0.1 % | ||
| CVE-2024-47893 | 1.15 RTM – 24.3 RTM | GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups) | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-1706 | 24.1 RTM – 24.3 RTM | GPU DDK - Improper locking when accessing the pvr_exp_fence object | HIGH 7.5 | 0.5 % | ||
| CVE-2025-0467 | 1.15 RTM – 24.3 RTM | GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write | HIGH 8.2 | 0.2 % | ||
| CVE-2025-25178 | 1.15 RTM – 24.3 RTM | GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory | HIGH 7.8 | 0.3 % | ||
| CVE-2025-0468 | 1.15 RTM – 24.3 RTM | GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA) | HIGH 7.1 | 0.2 % | ||
| CVE-2025-0835 | 23.2 RTM – 24.2 RTM2 | GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails | HIGH 7.8 | 0.2 % | ||
| CVE-2025-0478 | 1.15 RTM – 24.3 RTM2 | GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object | HIGH 7.8 | 0.1 % | ||
| CVE-2024-12837 | 1.15 RTM – 24.3 RTM | GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size | HIGH 7.8 | 0.2 % | ||
| CVE-2024-12576 | 1.15 RTM – 24.3 RTM | GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address | MEDIUM 5.5 | 0.1 % | ||
| CVE-2024-12577 | 1.15 RTM – 24.3 RTM | GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet | HIGH 7.3 | 0.2 % | ||
| CVE-2024-52939 | 1.15 RTM – 24.3 RTM | GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write | HIGH 7.8 | 0.2 % | ||
| CVE-2024-47896 | 1.15 RTM – 24.3 RTM | GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex | LOW 3.3 | 0.2 % | ||
| CVE-2024-46975 | 1.15 RTM – 24.3 RTM | GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping | HIGH 7.9 | 0.2 % | ||
| CVE-2024-47900 | 1.15 RTM – 24.3 RTM2 | GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes | HIGH 7.8 | 0.2 % | ||
| CVE-2024-47899 | 1.17 RTM – 24.3 RTM2 | GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition | HIGH 7.8 | 0.2 % | ||
| CVE-2024-47898 | 1.17 RTM – 24.3 RTM2 | GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition | HIGH 7.8 | 0.2 % | ||
| CVE-2024-47891 | 1.15 RTM – 24.3 RTM2 | GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition | HIGH 7.8 | 0.2 % | ||
| CVE-2024-46974 | 1.15 RTM – 24.3 RTM | GPU DDK - Arbitrary write of read-only dmabuf | HIGH 7.8 | 0.2 % | ||
| CVE-2024-52938 | 1.15 RTM – 24.2 RTM2 | GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write | HIGH 7.8 | 0.2 % | ||
| CVE-2024-52937 | 23.2 RTM2 – 24.2 RTM2 | GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore | MEDIUM 6.7 | 0.2 % | ||
| CVE-2024-52936 | 1.15 RTM – 24.2 RTM2 | GPU DDK - rgxfw_hwperf_config OOB read & write | MEDIUM 4.4 | 0.2 % | ||
| CVE-2024-52935 | 1.15 RTM – 24.2 RTM2 | GPU DDK - psContext->eDM gives OOB write | MEDIUM 4.1 | 0.2 % | ||
| CVE-2024-47895 | 1.15 RTM – 24.2 RTM2 | GPU DDK - OOB read into fwlog due to unchecked block count | HIGH 7.1 | 0.2 % | ||
| CVE-2024-47894 | 1.15 RTM – 24.2 RTM2 | GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds | HIGH 7.1 | 0.2 % | ||
| CVE-2024-47897 | 23.2 RTM2 – 24.2 RTM2 | GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write | HIGH 8.8 | 0.6 % | ||
| CVE-2024-43705 | 1.13 RTM – 24.2 RTM2 | GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so) | HIGH 7.8 | 0.1 % | ||
| CVE-2024-46973 | 1.15 RTM – 24.2 RTM2 | Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement | HIGH 7.8 | 0.2 % | ||
| CVE-2024-46972 | 24.1 RTM | GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence | HIGH 7.8 | 0.2 % | ||
| CVE-2024-47892 | 1.13 RTM – 24.2 RTM1 | GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA) | HIGH 7.8 | 0.1 % | ||
| CVE-2024-46971 | 1.13 RTM – 24.2 RTM1 | GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems | HIGH 7.8 | 0.1 % | ||
| CVE-2024-43703 | 1.13 RTM – 24.2 RTM2 | GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF | HIGH 8.1 | 0.4 % | ||
| CVE-2024-43702 | 1.13 RTM – 24.2 RTM1 | GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages | HIGH 8.1 | 0.3 % | ||
| CVE-2024-43704 | 1.13 RTM – 24.2 RTM1 | GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused | HIGH 8.4 | 0.2 % | ||
| CVE-2024-43701 | 1.17 – 24.2 RTM1 | GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices | HIGH 7.8 | 0.1 % |