Database/Control plane, storage & DevOps
Imagination PowerVR GPU driver - memory residue: An unprivileged application gets the GPU driver to hand back
Impact
An unprivileged application gets the GPU driver to hand back uninitialized heap memory, disclosing whatever the previous consumer left there. Same residual-memory class as LeftoverLocals and included here as evidence the class is a driver-design pattern rather than a one-off - if you evaluate a non-NVIDIA accelerator, ask the vendor specifically what their driver zeroes on allocation.
Who can reach it
An unprivileged local application with access to the GPU device node.
What to do
Update to the fixed Imagination DDK / vendor driver. In the datacenter this matters as a due-diligence question rather than a fleet action: PowerVR is not a datacenter part. Cost: driver update and reload where it applies.
References
Related entries
- Linux HID/amd_sfh - shift out of bounds: A shift operation in the AMD Sensor Fusion Hub driver exceeds the maximumCVE-2023-53703 · Linux HID/amd_sfh - shift out of boundsUnscored
- Linux perf/x86/amd - general protection fault from a NULL event on enable: A subtle race lets cpucCVE-2025-68798 · Linux perf/x86/amd - general protection fault from a NULL event on enableUnscored
- Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
- DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored
- Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLBCVE-2026-64229 · Linux x86/mm - broadcast TLB flush with PCID disabledUnscored
- Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT): The ccp driver initialised SNP from the SNP_COMMIT ioctlCVE-2026-64309 · Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.