Vulnerability · Published Oct 30, 2026 · Assigned by imaginationtech

CVE-2026-15466GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()

High 7.0

In plain English

A high-severity use-after-free in Graphics DDK from Imagination Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.1%top 97.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.

Affected products (as reported)

Vendor	Product	Versions
Imagination Technologies	Graphics DDK	24.2 RTM225.1 RTM2 – through 25.3 RTM26.1 RTM2

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/