CVE-2026-41156 — GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference

Description (CNA)

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing it.

Affected (CNA)

Vendor / product	Versions
Imagination Technologies / Graphics DDK	affected 1.18 RTM; affected 23.2 RTM; affected 24.2 RTM; affected 25.1 RTM through 25.3 RTM; affected 26.1 RTM; unaffected 26.2 RTM

CWE

CWE-416

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.