CVE-2026-41154
GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
HIGH 7.8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- imaginationtech
- NVD status
- Analyzed
Description
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
Weaknesses (CWE)
- CWE-787 — Out-of-bounds Write
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-43034
- GCVE · GCVE-0-2026-41154
Affected configurations (NVD CPE)
cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*< 26.1cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Imagination Technologies · Graphics DDK | unaffected 1.18 RTM2 ; unaffected 23.2 RTM2 ; affected 24.2 RTM2 ; affected 25.1 RTM2 ≤ 25.3 RTM ; affected 26.1 RTM1 ; unaffected 26.1 RTM2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |