CVE-2026-45199: GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the affected GPU driver development kit in a virtualized GPU environment are exposed when software can be installed and run inside a Guest VM. The issue is triggered by commands sent from guest kernel software to the GPU firmware.
What level of access does an attacker need?
An attacker needs the ability to install and run kernel software within a Guest VM. The provided information does not indicate that an unprivileged guest user alone can trigger the issue.
What is the potential impact?
Improper GPU commands can cause writes outside the Guest VM's virtualized GPU memory and other out-of-bounds memory accesses. These accesses may be used for privilege escalation.