CVE-2026-45203 PUBLISHED

GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU

Assigner: imaginationtech
Reserved: 11.05.2026 Published: 10.07.2026 Updated: 10.07.2026

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel.

A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

Product Status

Vendor Imagination Technologies
Product Graphics DDK
Versions Default: unknown
  • Version 1.18 RTM2 is affected
  • Version 23.2 RTM2 is affected
  • Version 24.2 RTM2 is affected
  • affected from 25.1 RTM2 to 25.3 RTM (incl.)
  • Version 26.1 RTM1 is affected
  • Version 26.1 RTM2 is unaffected

References

Problem Types

  • CWE - CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition (4.20) CWE

Impacts

  • CAPEC - CAPEC-480: Escaping Virtualization (Version 3.9)