Vulnerability · Published Jul 10, 2026 · Assigned by imaginationtech
CVE-2026-41154GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
High 7.8
In plain English
A high-severity out-of-bounds write in Graphics DDK from Imagination Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 92.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Imagination Technologies | Graphics DDK | 24.2 RTM225.1 RTM2 – through 25.3 RTM26.1 RTM1 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H