{"api_version":"1","generated_at":"2026-07-23T15:18:20+00:00","cve":"CVE-2026-41154","urls":{"html":"https://cve.report/CVE-2026-41154","api":"https://cve.report/api/cve/CVE-2026-41154.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-41154","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-41154"},"summary":{"title":"GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse","description":"Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.\n\n\n\nWhen indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.","state":"PUBLISHED","assigner":"imaginationtech","published_at":"2026-07-10 21:16:54","updated_at":"2026-07-13 19:24:52"},"problem_types":["CWE-787","CWE-787 CWE-787: Out-of-bounds Write"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","name":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","refsource":"367425dc-4d06-4041-9650-c2dc6aaa27ce","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41154","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41154","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"unaffected 1.18 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"unaffected 23.2 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 24.2 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 25.1 RTM2 25.3 RTM custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 26.1 RTM1 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"unaffected 26.1 RTM2 custom","platforms":["Linux","Android"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"41154","cve":"CVE-2026-41154","epss":"0.001310000","percentile":"0.030950000","score_date":"2026-07-14","updated_at":"2026-07-15 00:14:55"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-41154","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-13T18:19:41.693234Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-13T18:55:25.696Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","platforms":["Linux","Android"],"product":"Graphics DDK","vendor":"Imagination Technologies","versions":[{"status":"unaffected","version":"1.18 RTM2","versionType":"custom"},{"status":"unaffected","version":"23.2 RTM2","versionType":"custom"},{"status":"affected","version":"24.2 RTM2","versionType":"custom"},{"lessThanOrEqual":"25.3 RTM","status":"affected","version":"25.1 RTM2","versionType":"custom"},{"status":"affected","version":"26.1 RTM1","versionType":"custom"},{"status":"unaffected","version":"26.1 RTM2","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.</p><p>When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.</p>"}],"value":"Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.\n\n\n\nWhen indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access."}],"impacts":[{"capecId":"CAPEC-123","descriptions":[{"lang":"en","value":"CAPEC-123: Buffer Manipulation"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-10T20:46:06.747Z","orgId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","shortName":"imaginationtech"},"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}],"source":{"discovery":"UNKNOWN"},"title":"GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","assignerShortName":"imaginationtech","cveId":"CVE-2026-41154","datePublished":"2026-07-10T20:46:06.747Z","dateReserved":"2026-04-17T16:26:03.730Z","dateUpdated":"2026-07-13T18:55:25.696Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-10 21:16:54","lastModifiedDate":"2026-07-13 19:24:52","problem_types":["CWE-787","CWE-787 CWE-787: Out-of-bounds Write"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-13T18:19:41.693234Z","id":"CVE-2026-41154","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"41154","Ordinal":"1","Title":"GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of All","CVE":"CVE-2026-41154","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"41154","Ordinal":"1","NoteData":"Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.\n\n\n\nWhen indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.","Type":"Description","Title":"GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of All"}]}}}