CVE-2026-41154: GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
Published Jul 10, 2026
·Updated
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.
When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
Affected Software
5 affected components
GPU DDK AllocOSPages_Sparse
All of the following
Any of the following
Imaginationtech Ddk<26.1
Imaginationtech Ddk=26.1-rtm1
Any of the following
Google Android
Linux Linux kernel
Event History
Jul 10, 2026
CVE Published
via MITRE·08:46 PM
Data Sourced
via MITRE·08:46 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-41154?
CVE-2026-41154 has a high severity rating of 7.8 on the CVSS scale.
2
How do I fix CVE-2026-41154?
To fix CVE-2026-41154, ensure that you update to the latest version of the GPU DDK software that addresses this vulnerability.
3
What are the potential impacts of CVE-2026-41154?
CVE-2026-41154 can lead to out-of-bounds (OOB) kernel memory reads or writes, posing a risk of system compromise.
4
Who is affected by CVE-2026-41154?
CVE-2026-41154 affects software installed and run by non-privileged users utilizing the GPU DDK AllocOSPages_Sparse.
5
When was CVE-2026-41154 published?
CVE-2026-41154 was published on July 10, 2026.