CVE-2026-65584 Details
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash. The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
A stack overflow vulnerability has been identified in the GPU driver from Imagination Technologies, specifically in the GPU Device Driver Kit (DDK) releases up to and including 25.2 RTM. This vulnerability allows software running as a non-privileged user to make improper GPU system calls that lead to a stack overflow in the kernel. The overflow occurs while processing resolved Linux/Android fence synchronization checkpoints, excluding user checkpoints from the stack array. Successful exploitation can corrupt kernel memory, typically causing a kernel crash and a denial-of-service condition.
Users can update to the latest version of the Imagination Technologies GPU Driver that addresses this vulnerability. Instructions for updating the driver can be found on the Imagination Technologies website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| Imagination Technologies GPU DDK | <= 25.2 RTM <= 25.1 RTM2 <= 25.3 RTM <= 26.1 RTM1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | imaginationtech |