Imagination Technologies vulnerabilities
95 CVEs and advisories name Imagination Technologies as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-41157GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
- CVE-2026-41155GPU DDK - SharedSecMem mapped into all GPU virtual address spaces
- CVE-2026-34195GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes
- CVE-2026-34194GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count
- CVE-2026-22164GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical
- CVE-2026-34193GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()
- CVE-2026-22166GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable
- CVE-2026-22165GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs
- CVE-2026-22167GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory
- CVE-2026-21733GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)
- CVE-2026-22163GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
- CVE-2026-21732GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
- CVE-2026-21736GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled
- CVE-2025-13952GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
- CVE-2025-10865GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns
- CVE-2025-58411GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
- CVE-2025-58409GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory
- CVE-2025-25176GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
- CVE-2025-58408GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
- CVE-2025-58407GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet
- CVE-2025-58410GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
- CVE-2025-46711GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused
- CVE-2025-25177GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF
- CVE-2025-46709GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak
- CVE-2025-6573GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite
- CVE-2025-8109GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation
- CVE-2025-25180GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist
- CVE-2025-46708GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
- CVE-2025-46707GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
- CVE-2025-46710Possible kernel exceptions caused by reading and writing kernel heap data after free.