CVE-2026-34196

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping The second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:imaginationtech:ddk::::::::
	cpe:2.3:a:imaginationtech:ddk:26.1:rtm1::::::

OR	cpe:2.3:o:google:android:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) El software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU impropias para causar un desbordamiento de entero y mapear dos direcciones virtuales de GPU a la misma dirección física. Uno de estos mapeos virtuales puede ser liberado junto con la página física, permitiendo un UAF de lectura/escritura a través del segundo mapeo. El segundo mapeo virtual hace referencia a una dirección física que ha sido liberada después de que el primer mapeo virtual haya sido liberado. Esto permite que la memoria física sea asignada (por ejemplo) por otro proceso y se lea/escriba en ella.

Information

Published : 2026-07-10 21:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-34196

Mitre link : CVE-2026-34196

CVE.ORG link : CVE-2026-34196

JSON object : View

Products Affected

google

android

imaginationtech

ddk

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2026-34196", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34196", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T18:18:40.279772Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2026-07-10T21:16:54.297", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping\n\n\n\nThe second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to."}, {"lang": "es", "value": "El software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU impropias para causar un desbordamiento de entero y mapear dos direcciones virtuales de GPU a la misma direcci\u00f3n f\u00edsica. Uno de estos mapeos virtuales puede ser liberado junto con la p\u00e1gina f\u00edsica, permitiendo un UAF de lectura/escritura a trav\u00e9s del segundo mapeo.\n\nEl segundo mapeo virtual hace referencia a una direcci\u00f3n f\u00edsica que ha sido liberada despu\u00e9s de que el primer mapeo virtual haya sido liberado. Esto permite que la memoria f\u00edsica sea asignada (por ejemplo) por otro proceso y se lea/escriba en ella."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97C60721-9E04-406B-8036-D7799D679CD8", "versionEndExcluding": "26.1"}, {"criteria": "cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6047F4B-B29A-44F7-8F80-8A53C1917F38"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}