CVE-2026-7639 Details
Description
Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.
A use-after-free vulnerability has been identified in the Imagination Technologies GPU driver, specifically in the GPU Device Driver Kit (DDK) releases up to and including 26.1 RTM1. This vulnerability allows software running as a non-privileged user to exploit improper GPU system calls, leading to unauthorized access to memory through shader code. The issue arises from a failure to properly manage resource reference counting, creating a scenario where freed memory can be accessed again. Additionally, the vulnerability can be triggered by manipulating the Memory Management Unit (MMU) mapping logic, causing incomplete cleanup of the driver's internal state and allowing future unauthorized access to physical memory contents.
The DDK kernel module has been updated to address this vulnerability by correcting the management of resource references and preventing memory from being prematurely freed. Users should update to the latest version of the GPU DDK that includes this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-459 | Incomplete Cleanup | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| imaginationtech ddk | < 26.1 26.1 rtm1 |
CPE
Remediation
| |
| google android | All versions |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | imaginationtech |