CVE-2026-41155: GPU Privilege Escalation Vulnerability

CVE-2026-41155 Overview

CVE-2026-41155 affects the Imagination Technologies GPU kernel driver. The flaw allows shared secure memory allocations to be passed cooperatively between secure GPU processes. A local attacker with low privileges can corrupt shared GPU resources used by other secure processes. Exploitation can disrupt another secure GPU process, leading to image corruption or forced GPU hardware recovery.

The vulnerability is classified under [CWE-653] (Improper Isolation or Compartmentalization). It requires local access and low privileges with no user interaction. Impact is limited to availability, with no direct confidentiality or integrity loss on the host system.

Critical Impact
A local low-privileged attacker can disrupt secure GPU workloads of other users by corrupting shared secure memory, causing image corruption and GPU hardware recovery events.

Affected Products

Imagination Technologies GPU kernel module (driver)
Devices using affected Imagination GPU drivers with secure GPU process support
Refer to the Imagination Technologies Driver Vulnerabilities advisory for specific affected driver versions

Discovery Timeline

2026-06-12 - CVE-2026-41155 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-41155

Vulnerability Analysis

The vulnerability resides in the Imagination Technologies GPU kernel module that manages secure GPU process isolation. Secure GPU processes are designed to operate in isolated contexts. The kernel module permits multiple secure GPU processes to share the same secure memory allocations.

This shared allocation model breaks the isolation boundary between distinct secure GPU contexts. Two cooperating secure GPU processes can pass data through shared secure memory regions. The shared resource also serves as a corruption vector against non-cooperating secure processes.

When an attacker corrupts a shared secure memory allocation, downstream consumers of that memory operate on tainted data. This results in rendering output corruption or GPU faults that require a full hardware recovery sequence. The recovery resets the GPU state and disrupts all active GPU workloads.

Root Cause

The root cause is improper isolation [CWE-653] between secure GPU processes. The kernel module does not enforce a strict ownership boundary on secure memory allocations. Multiple secure processes are granted access to the same backing memory, violating the compartmentalization model that secure GPU contexts depend on.

Attack Vector

Exploitation requires local access to the device with low privileges sufficient to instantiate a secure GPU process. An attacker creates a secure GPU process that obtains a handle to a shared secure memory allocation. The attacker then writes attacker-controlled data into that allocation while a victim secure GPU process consumes it. The victim process either renders corrupted output or triggers a GPU fault, forcing a hardware recovery cycle that disrupts other users.

No verified public exploit code is available. Refer to the Imagination Technologies Driver Vulnerabilities advisory for vendor technical details.

Detection Methods for CVE-2026-41155

Indicators of Compromise

Unexpected GPU hardware recovery events recorded in kernel logs (dmesg) referencing the Imagination GPU driver
Repeated secure GPU process crashes or rendering artifacts in graphical output for unrelated workloads
Kernel messages indicating faults or resets in the Imagination GPU kernel module on multi-user or multi-tenant systems

Detection Strategies

Monitor kernel ring buffer output for GPU reset, fault, or recovery messages tied to the Imagination driver subsystem
Audit processes that open the GPU device node and create secure GPU contexts, correlating with users without legitimate GPU workloads
Baseline normal GPU workload behavior and alert on anomalous secure context creation rates from low-privilege user accounts

Monitoring Recommendations

Forward kernel logs and driver telemetry into a centralized log analytics platform for correlation across endpoints
Track GPU hardware recovery counts per host and alert on spikes that may indicate abuse of shared secure memory allocations
Monitor for unprivileged processes accessing GPU device nodes outside expected application sets

How to Mitigate CVE-2026-41155

Immediate Actions Required

Apply the Imagination Technologies GPU driver update referenced in the vendor advisory as soon as it is available for your platform
Restrict access to GPU device nodes to trusted users only on multi-tenant systems
Inventory devices running Imagination GPU drivers and prioritize patching for systems with multiple local users

Patch Information

Imagination Technologies publishes affected driver versions and fixed releases on its GPU driver vulnerabilities page. Downstream system-on-chip vendors and device manufacturers must integrate the fixed driver into their platform updates. Confirm the patched driver version with the device or OS vendor before deployment.

Workarounds

Limit creation of secure GPU contexts to trusted applications and users via filesystem permissions on GPU device nodes
Avoid running mutually untrusted workloads that use secure GPU processes on the same host until the driver is patched
Where feasible, disable secure GPU process features on systems that do not require them

bash

# Restrict GPU device node access to a dedicated group (example)
sudo groupadd gpu-users
sudo chown root:gpu-users /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128
sudo usermod -aG gpu-users <trusted-user>