Advisories · Technology
Imagination Technologies Graphics DDK.
Every CVE that names Imagination Technologies Graphics DDK among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
GPU DDK - OOB write in UntwiddlePOTSquare64bpp
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 9.8 CriticalCritical · CVSS 9+
GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.1 High
GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.5 High
GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 5.5 Medium
GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.1 High
GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.0 High
GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 2.5 Low
GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet
- Imagination Technologies Graphics DDK
- Race condition
- CVSS 7.8 High
GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 5.5 Medium
GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory
- Imagination Technologies Graphics DDK
- CWE-1284
- CVSS 7.8 High
GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.1 High
GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 5.5 Medium
GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.8 High
GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.8 High
GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU
- Imagination Technologies Graphics DDK
- Race condition
- CVSS 7.8 High
GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 7.8 High
GPU DDK - Page UAF read in PMMETA_PROTECT heap memory
- Imagination Technologies Graphics DDK
- CWE-459
- CVSS 7.8 High
GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 7.7 High
GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.7 High
GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.7 High
GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 5.5 Medium
GPU DDK - SharedSecMem mapped into all GPU virtual address spaces
- Imagination Technologies Graphics DDK
- CWE-653
- CVSS 8.8 High
GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.1 High
GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count
- Imagination Technologies Graphics DDK
- CWE-468
- CVSS 7.5 High
GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 4.3 Medium
GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 8.1 High
GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 8.1 High
GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.3 High
GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)
- Imagination Technologies Graphics DDK
- CWE-20
- CWE-280
- CVSS 7.8 High
GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
- Imagination Technologies Graphics DDK
- CWE-820
- CVSS 9.6 CriticalCritical · CVSS 9+
GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 4.4 Medium
GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 9.8 CriticalCritical · CVSS 9+
GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 8.8 High
GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 3.5 Low
GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
- Imagination Technologies Graphics DDK
- Information disclosure
- CVSS 5.9 Medium
GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.4 High
GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet
- Imagination Technologies Graphics DDK
- Race condition
- CVSS 7.5 High
GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 5.5 Medium
GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 5.1 Medium
GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.5 High
GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 8.8 High
GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 7.8 High
GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 4.3 Medium
GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 5.2 Medium
GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
- Imagination Technologies Graphics DDK
- Information disclosure
- CVSS 5.7 Medium
Use after free in Imagination Technologies Graphics DDK
- Imagination Technologies Graphics DDK
- Memory corruption