---
id: CVE-2026-65586
title: >-
  GPU DDK - Write UAF due to missing cleanup reference for abort command
  submitted via PVRSRVRGXKickTA3DKM
summary: >-
  Software installed and run as a non-privileged user may conduct improper GPU
  system calls to free memory in still in use, replace with another allocation
  and cause arbitrary memory reads or writes to physical memory pages.




  A memory bu…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-416
vendor: Imagination Technologies
product: Graphics DDK
affected:
  - graphics_ddk 1.18 RTM2
  - graphics_ddk 23.2 RTM2
  - graphics_ddk 24.2 RTM2
  - graphics_ddk >= 25.1 RTM2 <= 25.3 RTM
  - graphics_ddk 26.1 RTM2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:36:50.270863Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:37:14.596Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-65586'
references:
  - url: 'https://www.imaginationtech.com/gpu-driver-vulnerabilities/'
tags:
  - cve.org
epss: 0.0014
epssPercentile: 0.03358
ingestedAt: '2026-11-03T09:40:52.167Z'
---

## Overview

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages.



A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).

## Affected

- `graphics_ddk 1.18 RTM2`
- `graphics_ddk 23.2 RTM2`
- `graphics_ddk 24.2 RTM2`
- `graphics_ddk >= 25.1 RTM2 <= 25.3 RTM`
- `graphics_ddk 26.1 RTM2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.