CVE-2026-15465None▾ SunlitSoftware installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memor…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot.
The weakness occurs when software references memory after it has been released. Accessing memory after free may result in corruption of valid data structures, unexpected program behaviour, process crashes, or execution of unintended operations.
graphics_ddk 1.18 RTM2graphics_ddk 23.2 RTM2graphics_ddk 24.2 RTM2graphics_ddk 25.1 RTM2graphics_ddk 25.3 RTMgraphics_ddk 26.1 RTM2graphics_ddk 26.2 RTMRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15466High· 7.0GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
CVE-2026-65586High· 7.1GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
CVE-2026-45200High· 7.8Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a spec…
CVE-2026-74912Critical· 9.8GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
CVE-2026-74915High· 8.8GPU DDK - OOB write in UntwiddlePOTSquare64bpp
CVE-2026-18629High· 7.5GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation