Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-65586— GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM

Quick assessment

Affected

Imagination Technologies Graphics DDK

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以非特权用户身份安装并运行的软件，可能发起不当的 GPU 系统调用，释放仍在使用中的显存，随后将其替换为新的分配，从而引发对物理内存页的任意读取或写入。由 CPU 控制线程（驱动程序）管理、并由 GPU 控制线程（固件）访问的内存缓冲区，可能在其仍被使用时被释放。以非特权用户身份安装并运行的软件可将该缓冲区替换为另一个缓冲区，进而替换由 CPU 控制线程（驱动程序）管理的共享资源（即内存页地址列表），导致 GPU 访问未被 CPU 控制线程（驱动程序）管理的内存区域。

AI Predicted 9.8 Difficulty: Moderate Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1212.001

Updated Oct 30, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM

Source: CVE Program / CVE List V5

Vulnerability Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Imagination Technologies	Graphics DDK	1.18 RTM2	-

II. Public POCs for CVE-2026-65586

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-65586

请登录查看更多情报信息。

News Coverage for CVE-2026-65586 (1)

Imagination GPU Driver Vulnerabilities - Imagination

https://www.cve.org/CVERecord?id=CVE-2026-65586

Same Patch Batch · Imagination Technologies · 2026-10-30 · 8 CVEs total

CVE-2026-65584		GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
CVE-2026-15466		GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXClo
CVE-2026-65587		GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
CVE-2026-74912		GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
CVE-2026-74915		GPU DDK - OOB write in UntwiddlePOTSquare64bpp
CVE-2026-19199		GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
CVE-2026-18629		GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGP

IV. Related Vulnerabilities

Same product: Graphics DDK

Same vendor: Imagination Technologies

Same weakness: CWE-416