{"id":"CVE-2026-65586","aliases":[],"cve":{"records":[{"id":"CVE-2026-65586","source":"imaginationtech","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-22T10:44:41.844Z","published":"2026-10-30T01:42:18.824Z","modified":"2026-10-30T01:42:18.824Z"}],"publishers":[{"name":"imaginationtech","role":"CNA","organizationId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","modified":"2026-10-30T01:42:18.824Z"}],"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","tags":[],"source":"imaginationtech"}],"weaknesses":[{"id":"CWE-416","description":"CWE-416: Use After Free","source":"imaginationtech"}],"applicability":[],"prioritization":[]},"title":"GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM","titleSource":"imaginationtech","descriptionSource":"imaginationtech","description":"Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages.\n\n\n\nA memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).","score":null,"severity":"unknown","published":"2026-10-30T01:42:18.824Z","modified":"2026-10-30T01:42:18.824Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Imagination Technologies","name":"Graphics DDK","platforms":["Linux","Android"],"versions":[{"version":"1.18 RTM2","status":"affected","versionType":"custom"},{"version":"23.2 RTM2","status":"affected","versionType":"custom"},{"version":"24.2 RTM2","status":"affected","versionType":"custom"},{"version":"25.1 RTM2","status":"affected","lessThanOrEqual":"25.3 RTM","versionType":"custom"},{"version":"26.1 RTM2","status":"affected","versionType":"custom"},{"version":"26.2 RTM","status":"unaffected","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"imaginationtech","url":"https://www.cve.org/CVERecord?id=CVE-2026-65586"}],"remediation":[],"references":["https://www.imaginationtech.com/gpu-driver-vulnerabilities/"],"sources":[{"name":"CVE","id":"CVE-2026-65586","modified":"2026-10-30T01:42:18.824Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-65586"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T02:46:36.059Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:05:31.745Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-10-30T03:00:30.587Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T03:00:30.925Z","attemptedAt":"2026-10-30T03:00:30.925Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T03:00:30.925Z","attemptedAt":"2026-10-30T03:00:30.925Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T03:00:30.925Z","attemptedAt":"2026-10-30T03:00:30.925Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113478","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113478","modified":"Oct 30, 2026, 1:42:18 AM","checkedAt":"2026-10-30T03:00:30.925Z"}],"aiSummary":{"text":"Imagination Technologies' Graphics DDK versions 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2, and 26.1 RTM2 have a use-after-free weakness, allowing non-privileged users to conduct improper GPU system calls, potentially causing arbitrary memory reads or writes. The issue occurs due to a missing cleanup reference for an abort command. This may lead to the GPU accessing unmanaged memory.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:18:20.137Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-65586"}]}}