GPU VulnDB

Database/NVIDIA / GPU stack

Imagination Graphics DDK: TOCTOU in GPU firmware commands lets a guest VM read and write host memory

CVSS 7.4CVE-2025-58407NVIDIA / GPU stackcurated

Impact

A guest VM with the GPU driver loaded can post crafted commands to the GPU firmware and win a time-of-check/time-of-use race, producing reads and writes outside the memory allotted to that guest. The advisory describes this as escaping the virtual machine, which means the isolation boundary that makes GPU passthrough or mediated GPU sharing safe between tenants does not hold. On any host that shares one GPU across guests, a single tenant becomes a path to the host and to co-tenant memory. Note the scope limit for this database: Imagination GPUs are overwhelmingly embedded and SoC parts rather than datacenter accelerators, so most GPU fleets do not run this DDK - it is catalogued because the mechanism, a guest-driven race against GPU firmware, is the same class of flaw that matters wherever GPUs are virtualized.

Who can reach it

A local attacker inside a guest VM who controls kernel or driver software in that guest - i.e. anyone holding root in a VM with the GPU device attached. No host credentials needed. Attack complexity is rated high (AC:H), consistent with a race that must be won.

What to do

Update the Graphics DDK past the affected 25.2 release. In practice the DDK reaches operators through the SoC or platform vendor's BSP rather than directly from Imagination, so the fix arrives as a platform driver or firmware update and the host must be rebooted with guests stopped. The record names 25.2 as affected but does not state a fixed version; check the Imagination driver vulnerabilities page and your platform vendor for the release that carries the fix. Until then, do not share an affected GPU across guests you do not trust equally.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-58407https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.