CVE-2025-58408
GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
MEDIUM 5.9
At a glance
- Source
- NVD
- EPSS
- EPSS 0.13 % · percentile 3 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- imaginationtech
- NVD status
- Analyzed
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2025-199978
- GCVE · GCVE-0-2025-58408
CERT-FR advisories
- CERTFR-2026-AVI-0231 — Multiples vulnérabilités dans Google Android · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*≤ 25.2
Affected products
| Product | Versions |
|---|---|
| Imagination Technologies · Graphics DDK | affected 1.15 RTM ; affected 1.17 RTM ; affected 1.18 RTM ; affected 23.2 RTM ≤ 25.2 RTM2 ; unaffected 25.3 RTM |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |