CVE-2026-41154: GPU API Buffer Overflow Vulnerability

CVE-2026-41154 Overview

CVE-2026-41154 is an out-of-bounds (OOB) memory access vulnerability in the Imagination Technologies GPU driver. Non-privileged software can trigger OOB kernel memory reads or writes through GPU API calls. The flaw resides in the page freeing logic of the sparse memory implementation, where incorrect buffer indexing occurs when handling pages larger than 4kB. The vulnerability is classified as [CWE-787] Out-of-bounds Write and is exploitable locally by a low-privileged attacker.

Critical Impact
A local, low-privileged attacker can achieve OOB kernel memory reads and writes, potentially leading to privilege escalation, kernel memory corruption, or disclosure of sensitive kernel data.

Affected Products

Imagination Technologies GPU DDK (Driver Development Kit)
Systems-on-chip and devices shipping the affected PowerVR/IMG GPU driver
Any operating system integrating the vulnerable GPU kernel driver component

Discovery Timeline

2026-07-10 - CVE-2026-41154 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-41154

Vulnerability Analysis

The vulnerability exists in the Imagination Technologies GPU kernel driver's sparse memory implementation. Sparse memory allocations map only portions of a virtual address range to physical pages, allowing efficient management of large GPU resources. When the driver frees pages within these sparse mappings, it iterates over page indexes to release backing memory.

The driver's page freeing routine assumes a fixed 4kB page size when computing buffer indices. When the underlying page size exceeds 4kB, the index calculation does not correctly scale, resulting in reads or writes beyond the intended buffer boundaries. Because the affected buffers reside in kernel address space, the OOB access corrupts or discloses arbitrary kernel memory.

The issue is reachable through the GPU driver's user-facing ioctl and API surface. A non-privileged process can craft GPU allocations and free requests that traverse the flawed indexing path.

Root Cause

The root cause is incorrect buffer indexing in the page freeing logic of the sparse memory implementation. The code path does not properly account for page sizes larger than 4kB, so the computed offset into the tracking buffer exceeds its allocated length. This is a classic [CWE-787] out-of-bounds write, and the same defect also enables OOB reads depending on the code path exercised.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker executes a purpose-built process on the target device, opens the GPU driver device node, and issues GPU API calls that allocate sparse memory regions on a system configured with pages larger than 4kB. Subsequent free operations trigger the miscalculated index, corrupting kernel memory adjacent to the sparse tracking buffer. Skilled attackers can shape kernel allocations to escalate the OOB write into full kernel code execution or credential overwrite for privilege escalation.

No verified public exploit code is available at the time of publication. Technical details are documented in the Imagination Technologies Driver Vulnerabilities advisory.

Detection Methods for CVE-2026-41154

Indicators of Compromise

Unexpected kernel panics, oops messages, or GPU driver faults referencing sparse memory or page freeing functions
Non-privileged processes repeatedly opening GPU device nodes such as /dev/pvr_sync or vendor-specific IMG GPU nodes and issuing large sparse allocation and free sequences
Kernel log entries indicating memory corruption, slab corruption, or KASAN reports adjacent to GPU driver allocations

Detection Strategies

Monitor kernel ring buffer output (dmesg, journalctl -k) for GPU driver stack traces and OOB access warnings when kernel address sanitizers are enabled
Baseline normal GPU ioctl call patterns per process and flag anomalous volumes of sparse memory allocation and free requests from unprivileged binaries
Use endpoint telemetry to correlate process launches with GPU device access followed by kernel instability events on the same host

Monitoring Recommendations

Enable kernel crash reporting and forward crash dumps to a centralized log platform for correlation across the fleet
Track process access to GPU character devices and record command lines, parent processes, and user context
Alert on repeated GPU driver faults originating from the same non-privileged user or process tree within a short time window

How to Mitigate CVE-2026-41154

Immediate Actions Required

Inventory devices that ship Imagination Technologies GPU drivers, including embedded systems, mobile SoCs, and specialized compute platforms
Apply the driver update from the device vendor or SoC integrator as soon as it is available downstream
Restrict access to GPU device nodes so only trusted user accounts and services can invoke GPU APIs on affected systems

Patch Information

Imagination Technologies has published details of the fix on the GPU Driver Vulnerabilities advisory page. Because the vulnerable code ships inside a kernel driver distributed to OEMs and SoC vendors, patches reach end users through downstream BSPs (Board Support Packages), Android security bulletins, or Linux distribution kernel updates. Verify the driver DDK version reported by the vendor advisory and confirm that the updated build corrects the sparse memory page freeing logic.

Workarounds

Where kernel configuration permits, run the system with a 4kB base page size until the patched driver is deployed, since the flawed index path is triggered only by pages larger than 4kB
Tighten filesystem permissions and SELinux or AppArmor policies on GPU device nodes to prevent untrusted local users from issuing GPU API calls
Disable or unload the GPU kernel driver on systems that do not require GPU acceleration until a fixed version is installed

bash

# Restrict GPU device node access to a dedicated group
sudo groupadd gpuusers
sudo chgrp gpuusers /dev/dri/renderD128 /dev/dri/card0
sudo chmod 660 /dev/dri/renderD128 /dev/dri/card0

# Verify current kernel page size (must be 4096 to avoid the vulnerable path)
getconf PAGESIZE

# Review loaded GPU driver module and version
lsmod | grep -Ei 'pvr|img'
modinfo pvrsrvkm 2>/dev/null | grep -E '^(version|srcversion|filename)'