{"id":"CVE-2026-65584","title":"GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo","summary":"Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user ch…","severity":"none","cwe":["CWE-121"],"vendor":"Imagination Technologies","product":"Graphics DDK","affected":["graphics_ddk 1.18 RTM2","graphics_ddk 23.2 RTM2","graphics_ddk 24.2 RTM2","graphics_ddk >= 25.1 RTM2 <= 25.3 RTM","graphics_ddk 26.1 RTM2"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T01:52:21.452Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65584","references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.07046,"ingestedAt":"2026-11-03T09:40:52.167Z","slug":"CVE-2026-65584","body":"## Overview\n\nSoftware installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.\n\n\n\nThe code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.\n\n## Affected\n\n- `graphics_ddk 1.18 RTM2`\n- `graphics_ddk 23.2 RTM2`\n- `graphics_ddk 24.2 RTM2`\n- `graphics_ddk >= 25.1 RTM2 <= 25.3 RTM`\n- `graphics_ddk 26.1 RTM2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}