CVE-2026-41156 Details
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing it.
A write use-after-free vulnerability has been identified in the Imagination Technologies GPU driver development kit (DDK) releases up to and including 26.1 RTM1. This vulnerability allows software running as a non-privileged user to make improper GPU system calls that disrupt resource management. The issue arises when a CPU thread frees a shared memory page before a GPU thread has completed using it, creating a scenario where the GPU can write to a freed resource.
The DDK kernel module has been updated to ensure that resources are not freed prematurely while they are still in use. Users should update to the latest version of the Imagination Technologies GPU DDK to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| Imagination Technologies GPU DDK | <= 25.2 RTM <= 25.1 RTM2 <= 25.3 RTM <= 26.1 RTM1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | imaginationtech |