CVE-2026-45195

HIGH

GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted

Title source: cna

Description

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel. Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

References (1)

Core 1

Core References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Scores

CVSS v3 7.8

EPSS 0.0011

EPSS Percentile 1.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-280

Status published

Products (8)

Imagination Technologies/Graphics DDK 1.18 RTM

Imagination Technologies/Graphics DDK 23.2 RTM

Imagination Technologies/Graphics DDK 24.2 RTM

Imagination Technologies/Graphics DDK 25.1 RTM - 25.3 RTM

Imagination Technologies/Graphics DDK 26.1 RTM

Imagination Technologies/Graphics DDK 26.2 RTM

imaginationtech/ddk 26.1 rtm1

imaginationtech/ddk < 25.3

Published Jun 26, 2026

Tracked Since Jun 26, 2026