CVE-2026-34194

GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count

State: Published
Severity: 7.1 High
Published: Jun 8, 2026
Updated: Jun 8, 2026
Reserved: Mar 26, 2026

Read the record on cve.org

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation.

The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	CISA-ADP

Weaknesses

CWE-468 Incorrect Pointer Scaling

Affected Products

Product	Versions
Graphics DDKImagination Technologies	1.18 RTMNot affected 23.2 RTMNot affected 24.2 RTMAffected 25.1 RTM through 25.3 RTMAffected 26.1 RTMAffected

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.