CVE-2025-58411: GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-06-17
Weakness: CWE-416

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario. Improper resource management and reference counting on an internal resource caused scenario where potential write use after free was present.

Affected products

Imagination Technologies Graphics DDK: before 25.3 — fixed in 25.3

How to fix

Upgrade to a fixed version: Imagination Technologies Graphics DDK 25.3. Check the vendor advisory for mitigations.

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Get alerted when CVE-2025-58411 or the next vulnerability affects your stack