Executive brief
A vulnerability in the Imagination Technologies Graphics DDK (Driver Development Kit) allows a non-privileged user to gain unauthorized access to system memory. By making specific improper calls to the GPU, a malicious application can trick the system into mapping two different virtual addresses to the same physical memory location. This can lead to a 'use-after-free' scenario where the attacker can read or write to memory that has been reassigned to other processes, potentially leading to data theft or system instability.
Technical details
An integer overflow vulnerability exists in the Imagination Technologies Graphics DDK kernel module. A non-privileged local attacker can execute improper GPU system calls to cause two GPU virtual addresses to map to the same physical address. When one mapping is freed, the underlying physical page is also freed, but the second virtual mapping remains active. This creates a Use-After-Free (UAF) condition where the attacker can read from or write to physical memory that may have been reallocated to other processes or the kernel. The vulnerability is patched in Graphics DDK version 26.1 RTM2.
Affected products
- Imagination Technologies Graphics DDK 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 to 25.3 RTM, 26.1 RTM1
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory