CVE-2026-21733

Published: Apr 17, 2026Modified: Aug 12, 2026

7.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitability: 1.8 / Impact: 5.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files. This is caused by improper handling of GPU memory reservation protections.

Affected (2)

Products: Imaginationtech: Ddk

Imaginationtech

1 product

Ddk

Configuration A

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Imaginationtech Ddk	version < 25.3
Imaginationtech Ddk	Version 25.3 rtm

Running on/with	Platform Versions
Google Android	All versions
Linux Linux Kernel	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-280

Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

References (1)

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Source: 367425dc-4d06-4041-9650-c2dc6aaa27ce

Vendor Advisory

Timeline

No history available yet.