What’s Vulnerable › Vulnerabilities
CVE-2026-41154: GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-10 · updated 2026-10-25
- Weakness: CWE-787
Description
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
Affected products
- Imagination Technologies Graphics DDK: before 26.1; 26.1-rtm1 — fixed in 26.1
How to fix
Upgrade to a fixed version: Imagination Technologies Graphics DDK 26.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-41154 or the next vulnerability affects your stack