CVE-2026-65584None▾ SunlitSoftware installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user ch…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
graphics_ddk 1.18 RTM2graphics_ddk 23.2 RTM2graphics_ddk 24.2 RTM2graphics_ddk >= 25.1 RTM2 <= 25.3 RTMgraphics_ddk 26.1 RTM2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74915NoneGPU DDK - OOB write in UntwiddlePOTSquare64bpp
CVE-2026-74912NoneGPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
CVE-2026-15466NoneGPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
CVE-2026-18629NoneGPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
CVE-2026-19199NoneGPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
CVE-2026-65587NoneGPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change