CVE-2026-34192 Details
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.
A use-after-free vulnerability has been identified in the GPU driver from Imagination Technologies, specifically in the Graphics Processing Unit (GPU) Device Driver Kit (DDK) releases up to and including 26.1 RTM1. The vulnerability arises from improper management of GPU system calls by software running as a non-privileged user. This mismanagement creates an error path that fails to properly clean up before freeing physical memory allocated for Memory Management Unit (MMU) page tables. As a result, the vulnerability allows physical memory for the page tables to be accessed and used after it has been freed, potentially leading to unauthorized memory access or corruption.
The DDK kernel module has been updated to properly manage GPU system calls, ensuring that page table objects are cleaned up before the backing physical memory is freed. Users should update to the latest version of the Imagination Technologies GPU DDK to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| Imagination Technologies GPU DDK | <= 25.2 RTM <= 25.1 RTM2 <= 25.3 RTM <= 26.1 RTM1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | imaginationtech |