CVE-2025-10865 Details
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for use after free was present.
A use-after-free vulnerability has been identified in the Imagination Technologies GPU driver development kit (DDK) releases up to and including 25.2 RTM. This vulnerability arises from improper management of reference counting in internal resources, allowing software run by non-privileged users to make erroneous GPU system calls. The mismanagement creates a potential use-after-free scenario, where a resource can be freed while it is still in use, leading to undefined behavior or memory corruption.
The DDK kernel module has been updated to correct the improper use of GPU system calls, ensuring that resources are not freed prematurely while references still exist. Users should update to the latest version of the DDK that includes this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| imaginationtech ddk | < 25.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | imaginationtech |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 30, 2026 | Initial Analysis | [email protected] |
| Jan 14, 2026 | CVE Modified | CISA-ADP |
| Jan 13, 2026 | New CVE Received | imaginationtech |