GPU VulnDB

Database/NVIDIA / GPU stack

Imagination Graphics DDK: TOCTOU in guest command validation lets a guest read or write outside its GPU memory

UnscoredCVE-2026-45197NVIDIA / GPU stackcurated

Impact

The GPU firmware does validate the memory-access parameters a guest VM supplies, but the check can be invalidated between validation and use, so a guest kernel can drive reads or writes outside the GPU memory partition assigned to it. That is the one boundary GPU virtualisation exists to enforce, and it is enforced in firmware rather than by the host kernel, so a host-side hardening measure will not catch it. Note the affected product is Imagination's PowerVR-class DDK, which appears in embedded and SoC platforms rather than in NVIDIA or AMD datacenter fleets, so this is relevant only to operators running PowerVR-based accelerators with virtualisation enabled. The record carries no CVSS score and no detail beyond the TOCTOU and the out-of-bounds access.

Who can reach it

Kernel-level code inside a guest VM that has been assigned a virtualised share of the GPU. That means a tenant who already controls their own guest kernel, which is the normal state of affairs when you hand out VMs; it is not reachable from the network or from an unprivileged process in the guest.

What to do

Imagination lists fixed DDK versions on its GPU driver vulnerabilities page and the record names none, so read the version off that page for your platform. Fixes reach operators through the SoC vendor's BSP rather than a distro package, so the practical path is a platform-vendor driver and firmware update, and applying it means replacing the kernel-mode GPU driver plus firmware and rebooting the host with all guests stopped. Until an update exists for your platform, do not co-tenant untrusted guests on one virtualised GPU.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-45197https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.