CVE-2026-41154

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:imaginationtech:ddk::::::::
	cpe:2.3:a:imaginationtech:ddk:26.1:rtm1::::::

OR	cpe:2.3:o:google:android:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) El software instalado y ejecutado como un usuario no privilegiado puede causar lecturas o escrituras de memoria del kernel OOB a través de llamadas a la API de la GPU. Al indexar páginas de más de 4 kB en la lógica de liberación de páginas de la implementación de memoria dispersa, una indexación incorrecta del búfer conduce a un acceso OOB.

Information

Published : 2026-07-10 21:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-41154

Mitre link : CVE-2026-41154

CVE.ORG link : CVE-2026-41154

JSON object : View

Products Affected

google

android

imaginationtech

ddk

linux

linux_kernel

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-41154", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41154", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T18:19:41.693234Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "unaffected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "unaffected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2026-07-10T21:16:54.410", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.\n\n\n\nWhen indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access."}, {"lang": "es", "value": "El software instalado y ejecutado como un usuario no privilegiado puede causar lecturas o escrituras de memoria del kernel OOB a trav\u00e9s de llamadas a la API de la GPU.\n\nAl indexar p\u00e1ginas de m\u00e1s de 4 kB en la l\u00f3gica de liberaci\u00f3n de p\u00e1ginas de la implementaci\u00f3n de memoria dispersa, una indexaci\u00f3n incorrecta del b\u00fafer conduce a un acceso OOB."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97C60721-9E04-406B-8036-D7799D679CD8", "versionEndExcluding": "26.1"}, {"criteria": "cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6047F4B-B29A-44F7-8F80-8A53C1917F38"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}