CVE-2026-45196

Published: Jul 10, 2026Modified: Aug 12, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.

Affected (2)

Products: Imaginationtech: Ddk

Imaginationtech

1 product

Ddk

Configuration A

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Imaginationtech Ddk	Before 26.1
Imaginationtech Ddk	Version 26.1 rtm1

Running on/with	Platform Versions
Google Android	All versions
Linux Linux Kernel	All versions

Related CWEs

CWE-280

Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

References (1)

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Source: 367425dc-4d06-4041-9650-c2dc6aaa27ce

Vendor Advisory

Timeline

No history available yet.