{"id":"CVE-2026-65584","aliases":[],"cve":{"records":[{"id":"CVE-2026-65584","source":"imaginationtech","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-22T10:44:41.844Z","published":"2026-10-30T01:32:56.408Z","modified":"2026-10-30T01:52:21.452Z"}],"publishers":[{"name":"imaginationtech","role":"CNA","organizationId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","modified":"2026-10-30T01:52:21.452Z"}],"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","tags":[],"source":"imaginationtech"}],"weaknesses":[{"id":"CWE-121","description":"CWE-121: Stack-based Buffer Overflow","source":"imaginationtech"}],"applicability":[],"prioritization":[]},"title":"GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo","titleSource":"imaginationtech","descriptionSource":"imaginationtech","description":"Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.\n\n\n\nThe code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.","score":null,"severity":"unknown","published":"2026-10-30T01:32:56.408Z","modified":"2026-10-30T01:52:21.452Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Imagination Technologies","name":"Graphics DDK","platforms":["Linux","Android"],"versions":[{"version":"1.18 RTM2","status":"affected","versionType":"custom"},{"version":"23.2 RTM2","status":"affected","versionType":"custom"},{"version":"24.2 RTM2","status":"affected","versionType":"custom"},{"version":"25.1 RTM2","status":"affected","lessThanOrEqual":"25.3 RTM","versionType":"custom"},{"version":"26.1 RTM2","status":"affected","versionType":"custom"},{"version":"26.2 RTM","status":"unaffected"}],"defaultStatus":"unknown","cpes":[],"source":"imaginationtech","url":"https://www.cve.org/CVERecord?id=CVE-2026-65584"}],"remediation":[],"references":["https://www.imaginationtech.com/gpu-driver-vulnerabilities/"],"sources":[{"name":"CVE","id":"CVE-2026-65584","modified":"2026-10-30T01:52:21.452Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-65584"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T02:46:37.368Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:50:31.946Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-10-30T02:55:43.132Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T02:55:38.578Z","attemptedAt":"2026-10-30T02:55:38.578Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T02:55:37.302Z","attemptedAt":"2026-10-30T02:55:37.302Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T02:55:37.379Z","attemptedAt":"2026-10-30T02:55:37.379Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113477","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113477","modified":"Oct 30, 2026, 1:52:21 AM","checkedAt":"2026-10-30T02:55:37.302Z"}],"aiSummary":{"text":"Imagination Technologies' Graphics DDK versions 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2, and 26.1 RTM2 have a stack buffer overflow vulnerability via an undersized UFO address array. A non-privileged user may cause a kernel crash. The vulnerability is due to a buffer write beyond the allocated array on the stack.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:18:09.010Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-65584"}]}}