---
id: CVE-2026-19199
title: >-
  GPU DDK - OOB write due to freelist size integer overflow in
  RGXCreateHWRTDataSet
summary: >-
  Software installed and run as a non-privileged user may conduct improper
  system calls to allocate physical memory. A 32-bit integer overflow in the KM
  driver during page-to-byte conversion of an allocation size can result in an
  undersize…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-190
vendor: Imagination Technologies
product: Graphics DDK
affected:
  - graphics_ddk 1.18 RTM2
  - graphics_ddk 23.2 RTM2
  - graphics_ddk 24.2 RTM2
  - graphics_ddk >= 25.1 RTM2 <= 25.3 RTM
  - graphics_ddk 26.1 RTM2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:34:21.787579Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:34:49.978Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-19199'
references:
  - url: 'https://www.imaginationtech.com/gpu-driver-vulnerabilities/'
tags:
  - cve.org
epss: 0.0014
epssPercentile: 0.03359
ingestedAt: '2026-11-03T09:40:52.172Z'
---

## Overview

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.

## Affected

- `graphics_ddk 1.18 RTM2`
- `graphics_ddk 23.2 RTM2`
- `graphics_ddk 24.2 RTM2`
- `graphics_ddk >= 25.1 RTM2 <= 25.3 RTM`
- `graphics_ddk 26.1 RTM2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.