CVE-2026-45196 Details
Description
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.
A vulnerability exists in the Imagination Technologies GPU Driver Development Kit (DDK) that can lead to privilege escalation. This issue arises because kernel software running inside a Host virtual machine may send improper commands to the GPU firmware. These commands can trigger unauthorized access to GPU registers, potentially allowing a user to escalate privileges.
The DDK firmware component has been updated to sanitize kernel-accessible pointers and validate register addresses used in the hardware performance component.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-280 | Improper Handling of Insufficient Permissions or Privileges | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| imaginationtech ddk | < 26.1 26.1 rtm1 |
CPE
Remediation
| |
| google android | All versions |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | imaginationtech |