IImagination Technologies

Products

Exploited and recent CVEs

• CVE-2026-74915 High 8.8 GPU DDK - OOB write in UntwiddlePOTSquare64bpp 0.3%
• CVE-2026-74912 Critical 9.8 GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB 0.3%
• CVE-2026-19199 High 7.1 GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet 0.1%
• CVE-2026-18629 High 7.5 GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation 0.3%
• CVE-2026-65587 Medium 5.5 GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change <0.1%
• CVE-2026-65586 High 7.1 GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM 0.1%
• CVE-2026-65584 High 7.8 GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo 0.1%
• CVE-2026-15466 High 7.0 GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM() 0.1%
• CVE-2026-45197 Low 2.5 GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet <0.1%
• CVE-2026-45200 High 7.8 GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags 0.2%
• CVE-2026-45202 Medium 5.5 GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast` 0.1%
• CVE-2026-45201 High 7.8 GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory 0.2%
• CVE-2026-45199 High 7.8 GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers 0.2%
• CVE-2026-49746 High 7.1 GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem 0.2%
• CVE-2026-45204 Medium 5.5 GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory 0.2%
• CVE-2026-45198 High 7.8 GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted 0.2%
• CVE-2026-16280 Critical 9.8 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset 0.5%
• CVE-2026-49745 High 7.8 GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 0.2%
• CVE-2026-49744 High 7.8 GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() 0.2%
• CVE-2026-49743 High 7.8 GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed 0.2%
• CVE-2026-45203 High 7.8 GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU 0.1%
• CVE-2026-45196 High 7.8 GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel 0.1%
• CVE-2026-7639 High 7.8 GPU DDK - Page UAF read in PMMETA_PROTECT heap memory 0.2%
• CVE-2026-41154 High 7.8 GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse 0.2%
• CVE-2026-34196 High 7.8 GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem 0.2%
• CVE-2026-45195 High 7.8 GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted 0.1%
• CVE-2026-21734 High 7.7 GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation 0.2%
• CVE-2026-41156 High 7.7 GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference 0.2%
• CVE-2026-34192 High 7.7 GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries 0.2%
• CVE-2026-41158 High 7.8 GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink 0.1%