Ddk
Imaginationtech · 40 CVEs
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
Jul 24, 2026
GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
Jul 24, 2026
GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
Jul 24, 2026
GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed
Jul 24, 2026
GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU
Jul 10, 2026
GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel
Jul 10, 2026
GPU DDK - Page UAF read in PMMETA_PROTECT heap memory
Jul 10, 2026
GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
Jul 10, 2026
GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem
Jul 10, 2026
GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
Jun 26, 2026
GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
Jun 26, 2026
GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()
Jun 1, 2026
GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable
May 1, 2026
GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs
May 1, 2026
GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory
May 1, 2026
GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc…
Apr 17, 2026
GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
Mar 20, 2026
GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
Mar 20, 2026
GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled
Mar 9, 2026
GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
Jan 24, 2026
GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns
Jan 13, 2026
GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
Jan 13, 2026
GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupti…
Jan 13, 2026
GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
Jan 13, 2026
GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
Dec 1, 2025
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-16280 | GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset | CRITICAL | 0.53% | Jul 24, 2026 |
| CVE-2026-49745 | GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 | HIGH | 0.16% | Jul 24, 2026 |
| CVE-2026-49744 | GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() | HIGH | 0.16% | Jul 24, 2026 |
| CVE-2026-49743 | GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed | HIGH | 0.16% | Jul 24, 2026 |
| CVE-2026-45203 | GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU | HIGH | 0.13% | Jul 10, 2026 |
| CVE-2026-45196 | GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel | HIGH | 0.14% | Jul 10, 2026 |
| CVE-2026-7639 | GPU DDK - Page UAF read in PMMETA_PROTECT heap memory | HIGH | 0.18% | Jul 10, 2026 |
| CVE-2026-41154 | GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse | HIGH | 0.18% | Jul 10, 2026 |
| CVE-2026-34196 | GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem | HIGH | 0.17% | Jul 10, 2026 |
| CVE-2026-45195 | GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted | HIGH | 0.14% | Jun 26, 2026 |
| CVE-2026-21734 | GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation | HIGH | 0.16% | Jun 26, 2026 |
| CVE-2026-34193 | GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() | MEDIUM | 0.22% | Jun 1, 2026 |
| CVE-2026-22166 | GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable | HIGH | 0.39% | May 1, 2026 |
| CVE-2026-22165 | GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs | HIGH | 0.35% | May 1, 2026 |
| CVE-2026-22167 | GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory | HIGH | 0.15% | May 1, 2026 |
| CVE-2026-21733 | GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) | HIGH | 0.10% | Apr 17, 2026 |
| CVE-2026-22163 | GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU | HIGH | 0.08% | Mar 20, 2026 |
| CVE-2026-21732 | GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation | CRITICAL | 0.29% | Mar 20, 2026 |
| CVE-2026-21736 | GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled | MEDIUM | 0.12% | Mar 9, 2026 |
| CVE-2025-13952 | GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP | CRITICAL | 0.46% | Jan 24, 2026 |
| CVE-2025-10865 | GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns | HIGH | 0.13% | Jan 13, 2026 |
| CVE-2025-58411 | GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF | HIGH | 0.17% | Jan 13, 2026 |
| CVE-2025-58409 | GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory | LOW | 0.15% | Jan 13, 2026 |
| CVE-2025-25176 | GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world | CRITICAL | 0.35% | Jan 13, 2026 |
| CVE-2025-58408 | GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code | MEDIUM | 0.13% | Dec 1, 2025 |
Showing 1 to 25 of 40 CVEs