CVE-2026-22167

Vulnerability

Details The vulnerability in Imagination Technologies GPU driver stems from improper validation of GPU system calls made by non-privileged user-space software. Specifically, the driver fails to restrict GPU write operations to only allocated memory regions, allowing the GPU to write to arbitrary physical memory pages. This includes memory not allocated by the GPU driver, such as kernel memory and pages used by other drivers. [1]

Exploitation

An attacker with local access to a system running an affected Imagination GPU driver can exploit this by running specially crafted software that issues improper GPU system calls. No special privileges are required beyond the ability to execute user-space code. The GPU then performs unauthorized writes to physical memory, bypassing standard memory protection mechanisms.

Impact

Successful exploitation allows the attacker to corrupt data pages in use by the kernel and other drivers, potentially altering system behavior, leading to privilege escalation, denial of service, or information disclosure. The attack can also affect restricted internal GPU buffers, causing secondary corruption.

Mitigation

Imagination has addressed this vulnerability in a driver update. Users should apply the latest GPU driver version from the vendor to mitigate the risk. The vulnerability is considered high severity (CVSS 7.8). [1]