What’s Vulnerable › Vulnerabilities
CVE-2025-58410: GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-17 · updated 2026-10-07
- Weakness: CWE-280
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource.
Affected products
- Imagination Technologies Graphics DDK: 23.3-rtm, 24.1, 24.2, 24.2-rtm1, 24.2-rtm2, 24.3 (+3)
References
Get alerted when CVE-2025-58410 or the next vulnerability affects your stack