Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-65586unknown

GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM

Impact

Imagination Technologies' Graphics DDK versions 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2, and 26.1 RTM2 have a use-after-free weakness, allowing non-privileged users to conduct improper GPU system calls, potentially causing arbitrary memory reads or writes. The issue occurs due to a missing cleanup reference for an abort command. This may lead to the GPU accessing unmanaged memory.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Imagination Technologies · imaginationtech

Graphics DDK

6 ranges
imaginationtech version evidence
Platforms: Linux, Android

Compare with this publisher’s ranges. This does not inspect your installation.

affected

1.18 RTM2

custom versions

23.2 RTM2

custom versions

24.2 RTM2

custom versions

25.1 RTM2 → through 25.3 RTM

custom versions

26.1 RTM2

custom versions

unaffected

26.2 RTM

custom versions

unknown

Other versions: unknown

Original source description

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages.

A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-65586

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-416 ↗

CWE-416: Use After Free

imaginationtech

Related →
Contributing organizations · 1
imaginationtech

Assigning organization

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources
www.imaginationtech.com/gpu-driver-vulnerabilities/
Security advisoryimaginationtech