Executive brief
Imagination's GPU driver (DDK) contains a memory management flaw in its GPU memory allocation system. Non-privileged users can trigger improper GPU system calls that cause GPU memory leaks and potentially corrupt kernel heap memory. This could lead to system instability, data corruption, or serve as a stepping stone for further attacks.
Technical details
The vulnerability exists in Imagination's GPU DDK kernel module and stems from improper state management in memory free paths for upgraded higher-order GPU allocations. When the kernel frees GPU memory, it fails to maintain proper state tracking, leading to memory leaks or double-free conditions. Non-privileged users can conduct improper GPU system calls to trigger these code paths without requiring authentication or special privileges. An attacker can trigger resource mismanagement resulting in GPU memory leaks and potential kernel heap corruption. The DDK kernel module has been updated in later releases to address proper resource state tracking during memory free operations.
Affected products
- Imagination Technologies GPU DDK up to and including 25.2 RTM
Timeline
- 2026-08-21: disclosed