CVE-2026-49744

Summary

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.

Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.

Affected Software

VendorProductVersion RangeStatus
Imagination TechnologiesGraphics DDK1.18 RTM2affected
Imagination TechnologiesGraphics DDK23.2 RTM2affected
Imagination TechnologiesGraphics DDK24.2 RTM2affected
Imagination TechnologiesGraphics DDK25.1 RTM2 <= 25.3 RTMaffected
Imagination TechnologiesGraphics DDK26.1 RTM1unaffected

Weaknesses

  • CWE-823: CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References