CVE-2026-65586: GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages.
A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
A non-privileged user can exploit it through improper GPU system calls. The attacker needs the ability to install and run software on the affected system.
What access is required to trigger the vulnerability?
The issue is triggered through an abort command submitted via PVRSRVRGXKickTA3DKM. No elevated privileges are described as necessary.
What is the potential impact of successful exploitation?
An attacker may free a buffer while GPU firmware is still using it, replace the allocation, and cause arbitrary reads or writes to physical memory pages.