{"id":"CVE-2026-15466","aliases":[],"cve":{"records":[{"id":"CVE-2026-15466","source":"imaginationtech","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T21:04:03.553Z","published":"2026-10-30T01:23:24.460Z","modified":"2026-10-30T01:53:35.071Z"}],"publishers":[{"name":"imaginationtech","role":"CNA","organizationId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","modified":"2026-10-30T01:53:35.071Z"}],"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","tags":[],"source":"imaginationtech"}],"weaknesses":[{"id":"CWE-416","description":"CWE-416: Use After Free","source":"imaginationtech"}],"applicability":[],"prioritization":[]},"title":"GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()","titleSource":"imaginationtech","descriptionSource":"imaginationtech","description":"Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF.\n\n\n\nThe race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.","score":null,"severity":"unknown","published":"2026-10-30T01:23:24.460Z","modified":"2026-10-30T01:53:35.071Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Imagination Technologies","name":"Graphics DDK","platforms":["Linux","Android"],"versions":[{"version":"1.18 RTM2","status":"unaffected","versionType":"custom"},{"version":"23.2 RTM2","status":"unaffected","versionType":"custom"},{"version":"24.2 RTM2","status":"affected","versionType":"custom"},{"version":"25.1 RTM2","status":"affected","lessThanOrEqual":"25.3 RTM","versionType":"custom"},{"version":"26.1 RTM2","status":"affected","versionType":"custom"},{"version":"26.2 RTM","status":"unaffected","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"imaginationtech","url":"https://www.cve.org/CVERecord?id=CVE-2026-15466"}],"remediation":[],"references":["https://www.imaginationtech.com/gpu-driver-vulnerabilities/"],"sources":[{"name":"CVE","id":"CVE-2026-15466","modified":"2026-10-30T01:53:35.071Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-15466"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T02:46:41.383Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:05:31.745Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-10-30T02:55:42.931Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T02:55:37.202Z","attemptedAt":"2026-10-30T02:55:37.202Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T02:55:36.202Z","attemptedAt":"2026-10-30T02:55:36.202Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T02:55:36.204Z","attemptedAt":"2026-10-30T02:55:36.204Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113474","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113474","modified":"Oct 30, 2026, 1:53:35 AM","checkedAt":"2026-10-30T02:55:36.202Z"}],"aiSummary":{"text":"Imagination Technologies' Graphics DDK versions 24.2 RTM2, 25.1 RTM2 to 25.3 RTM, and 26.1 RTM2 have a use-after-free weakness due to a race condition in PVRSRVRGXCloseHWPerfClientStreamKM(). A non-privileged user may cause improper GPU system calls, leading to reads and/or writes of kernel heap memory.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:17:17.275Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-15466"}]}}