Imagination Technologies Graphics DDK

• CVE-2026-74915 High 8.8 GPU DDK - OOB write in UntwiddlePOTSquare64bpp 0.3%
• CVE-2026-74912 Critical 9.8 GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB 0.3%
• CVE-2026-19199 High 7.1 GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet 0.1%
• CVE-2026-18629 High 7.5 GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation 0.3%
• CVE-2026-65587 Medium 5.5 GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change <0.1%
• CVE-2026-65586 High 7.1 GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM 0.1%
• CVE-2026-65584 High 7.8 GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo 0.1%
• CVE-2026-15466 High 7.0 GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM() 0.1%
• CVE-2026-45197 Low 2.5 GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet <0.1%
• CVE-2026-45200 High 7.8 GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags 0.2%
• CVE-2026-45202 Medium 5.5 GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast` 0.1%
• CVE-2026-45201 High 7.8 GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory 0.2%
• CVE-2026-45199 High 7.8 GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers 0.2%
• CVE-2026-49746 High 7.1 GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem 0.2%
• CVE-2026-45204 Medium 5.5 GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory 0.2%
• CVE-2026-45198 High 7.8 GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted 0.2%
• CVE-2026-16280 Critical 9.8 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset 0.5%
• CVE-2026-49745 High 7.8 GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 0.2%
• CVE-2026-49744 High 7.8 GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() 0.2%
• CVE-2026-49743 High 7.8 GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed 0.2%
• CVE-2026-45203 High 7.8 GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU 0.1%
• CVE-2026-45196 High 7.8 GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel 0.1%
• CVE-2026-7639 High 7.8 GPU DDK - Page UAF read in PMMETA_PROTECT heap memory 0.2%
• CVE-2026-41154 High 7.8 GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse 0.2%
• CVE-2026-34196 High 7.8 GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem 0.2%
• CVE-2026-45195 High 7.8 GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted 0.1%
• CVE-2026-21734 High 7.7 GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation 0.2%
• CVE-2026-41156 High 7.7 GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference 0.2%
• CVE-2026-34192 High 7.7 GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries 0.2%
• CVE-2026-41158 High 7.8 GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink 0.1%
• CVE-2026-41157 Critical 9.8 GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D 0.4%
• CVE-2026-41155 Medium 5.5 GPU DDK - SharedSecMem mapped into all GPU virtual address spaces 0.1%
• CVE-2026-34195 High 8.8 GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes 0.3%
• CVE-2026-34194 High 7.1 GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count 0.1%
• CVE-2026-22164 High 7.5 GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical 0.3%
• CVE-2026-34193 Medium 4.3 GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() 0.1%
• CVE-2026-22166 High 8.1 GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable 0.4%
• CVE-2026-22165 High 8.1 GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs 0.3%
• CVE-2026-22167 High 7.8 GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory 0.2%
• CVE-2026-21733 High 7.3 GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) <0.1%
• CVE-2026-22163 High 7.8 GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU <0.1%
• CVE-2026-21732 Critical 9.6 GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation 0.3%
• CVE-2026-21736 Medium 4.4 GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled 0.1%
• CVE-2025-13952 Critical 9.8 GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP 0.5%
• CVE-2025-10865 High 7.8 GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns 0.1%
• CVE-2025-58411 High 8.8 GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF 0.2%
• CVE-2025-58409 Low 3.5 GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory 0.2%
• CVE-2025-25176 Critical 9.1 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world 0.4%
• CVE-2025-58408 Medium 5.9 GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code 0.1%
• CVE-2025-58407 High 7.4 GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet 0.2%