Imagination Technologies vulnerabilities
95 CVEs and advisories name Imagination Technologies as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-74915GPU DDK - OOB write in UntwiddlePOTSquare64bpp
- CVE-2026-74912GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
- CVE-2026-19199GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
- CVE-2026-18629GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
- CVE-2026-65587GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
- CVE-2026-65586GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
- CVE-2026-65584GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
- CVE-2026-15466GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
- CVE-2026-45197GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet
- CVE-2026-45200GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags
- CVE-2026-45202GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`
- CVE-2026-45201GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory
- CVE-2026-45199GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
- CVE-2026-49746GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem
- CVE-2026-45204GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory
- CVE-2026-45198GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted
- CVE-2026-16280GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
- CVE-2026-49745GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
- CVE-2026-49744GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
- CVE-2026-49743GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed
- CVE-2026-45203GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU
- CVE-2026-45196GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel
- CVE-2026-7639GPU DDK - Page UAF read in PMMETA_PROTECT heap memory
- CVE-2026-41154GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
- CVE-2026-34196GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem
- CVE-2026-45195GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
- CVE-2026-21734GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
- CVE-2026-41156GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference
- CVE-2026-34192GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries
- CVE-2026-41158GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink