Imagination Technologies Graphics DDK

• CVE-2025-58410 High 7.5 GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR 0.3%
• CVE-2025-46711 Medium 5.5 GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused 0.1%
• CVE-2025-25177 Medium 5.1 GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF 0.1%
• CVE-2025-46709 High 7.5 GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak 0.4%
• CVE-2025-6573 Critical 9.8 GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite 0.5%
• CVE-2025-8109 High 8.8 GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation 0.5%
• CVE-2025-25180 High 7.8 GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist 0.2%
• CVE-2025-46708 Medium 4.3 GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs 0.2%
• CVE-2025-46707 Medium 5.2 GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it 0.1%
• CVE-2025-46710 Medium 5.7 Possible kernel exceptions caused by reading and writing kernel heap data after free. 0.2%
• CVE-2025-25179 High 7.8 GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory 0.1%
• CVE-2024-47893 Medium 6.5 GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups) 0.3%
• CVE-2025-1706 High 7.5 GPU DDK - Improper locking when accessing the pvr_exp_fence object 0.5%
• CVE-2025-0467 High 8.2 GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write 0.2%
• CVE-2025-25178 High 7.8 GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory 0.3%
• CVE-2025-0468 High 7.1 GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA) 0.2%
• CVE-2025-0835 High 7.8 GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails 0.2%
• CVE-2025-0478 High 7.8 GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object 0.1%
• CVE-2024-12837 High 7.8 GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size 0.2%
• CVE-2024-12576 Medium 5.5 GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address 0.1%
• CVE-2024-12577 High 7.3 GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet 0.2%
• CVE-2024-52939 High 7.8 GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write 0.2%
• CVE-2024-47896 Low 3.3 GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex 0.2%
• CVE-2024-46975 High 7.9 GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping 0.2%
• CVE-2024-47900 High 7.8 GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes 0.2%
• CVE-2024-47899 High 7.8 GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition 0.2%
• CVE-2024-47898 High 7.8 GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition 0.2%
• CVE-2024-47891 High 7.8 GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition 0.2%
• CVE-2024-46974 High 7.8 GPU DDK - Arbitrary write of read-only dmabuf 0.2%
• CVE-2024-52938 High 7.8 GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write 0.2%
• CVE-2024-52937 Medium 6.7 GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore 0.2%
• CVE-2024-52936 Medium 4.4 GPU DDK - rgxfw_hwperf_config OOB read & write 0.2%
• CVE-2024-52935 Medium 4.1 GPU DDK - psContext->eDM gives OOB write 0.2%
• CVE-2024-47895 High 7.1 GPU DDK - OOB read into fwlog due to unchecked block count 0.2%
• CVE-2024-47894 High 7.1 GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds 0.2%
• CVE-2024-47897 High 8.8 GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write 0.6%
• CVE-2024-43705 High 7.8 GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so) 0.1%
• CVE-2024-46973 High 7.8 Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement 0.2%
• CVE-2024-46972 High 7.8 GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence 0.2%
• CVE-2024-47892 High 7.8 GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA) 0.1%
• CVE-2024-46971 High 7.8 GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems 0.1%
• CVE-2024-43703 High 8.1 GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF 0.4%
• CVE-2024-43702 High 8.1 GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages 0.3%
• CVE-2024-43704 High 8.4 GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused 0.2%
• CVE-2024-43701 High 7.8 GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices 0.1%