CVE-2026-41156: GPU Driver Use-After-Free Vulnerability

CVE-2026-41156 Overview

CVE-2026-41156 is a write use-after-free vulnerability in Imagination Technologies GPU driver components. A non-privileged local user can issue improper GPU system calls that cause mismanagement of a shared memory page. The CPU-side driver frees the page while the GPU firmware is still accessing it, producing a write UAF condition [CWE-416].

The flaw arises from a synchronization gap between two distinct threads of control: the CPU driver and the GPU firmware. Successful exploitation can corrupt kernel memory, leading to integrity and availability impact on the affected device.

Critical Impact
Local non-privileged code can trigger kernel memory corruption in GPU driver state, with the potential for privilege escalation or system crash.

Affected Products

Imagination Technologies GPU driver (DDK)
Imagination Technologies GPU firmware components
Systems integrating PowerVR/IMG GPU drivers with affected driver versions

Discovery Timeline

2026-06-19 - CVE-2026-41156 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-41156

Vulnerability Analysis

The vulnerability is a write use-after-free in the GPU driver stack. A memory page is shared between two independent execution contexts: the CPU thread running the kernel driver and the GPU thread running firmware. The CPU driver owns the lifecycle of the page and is responsible for allocating and freeing it.

When a non-privileged user invokes a crafted sequence of GPU system calls, the driver frees the shared page before the GPU firmware has finished writing to it. The firmware then continues to write into memory that has already been returned to the allocator. This produces a write UAF that corrupts whatever object now occupies the freed page.

Because the corruption originates from GPU firmware rather than from CPU instructions, the writes occur asynchronously and bypass CPU-side memory safety checks. Attackers controlling the timing and contents of GPU work can shape both when the write occurs and what data is written.

Root Cause

The root cause is missing or insufficient lifecycle synchronization between the CPU driver and GPU firmware over a shared resource. The driver does not wait for outstanding GPU references to the page to drain before releasing it back to the kernel allocator.

Attack Vector

The attack requires local access and the ability to execute code as a non-privileged user. The attacker submits crafted GPU system calls that schedule firmware work referencing a memory page, then triggers the driver path that frees the page while the firmware operation is still in flight. The race between free and firmware write yields the UAF. No user interaction is required. Refer to the Imagination Technologies Driver Vulnerabilities advisory for vendor technical details.

Detection Methods for CVE-2026-41156

Indicators of Compromise

Unexpected kernel panics or oops messages referencing GPU driver symbols or firmware faults
GPU firmware watchdog resets correlated with user-space processes issuing high volumes of ioctl calls to the GPU device node
Slab corruption warnings in kernel logs following GPU workload execution by non-privileged processes

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for SLUB/SLAB corruption, GPU driver assertions, and firmware reset events
Audit non-privileged processes opening /dev/dri/* or vendor GPU device nodes and issuing unusual ioctl sequences
Enable KASAN or equivalent kernel sanitizers in test environments to catch UAF conditions during validation

Monitoring Recommendations

Alert on repeated GPU firmware resets originating from the same process or user context
Track installation and execution of untrusted software on devices with affected GPU drivers
Correlate GPU subsystem error telemetry with subsequent privilege changes or anomalous kernel-mode activity

How to Mitigate CVE-2026-41156

Immediate Actions Required

Inventory devices and platforms that ship the Imagination Technologies GPU driver and identify affected versions
Apply vendor-supplied driver and firmware updates from the Imagination Technologies advisory as soon as they are available for your platform
Restrict execution of untrusted local software on affected systems until patches are deployed

Patch Information

Imagination Technologies publishes driver and firmware fixes through its GPU driver vulnerabilities portal. System integrators and OEMs must rebase to the patched DDK and firmware release and propagate the update to downstream platform BSPs and device images. Consult the vendor advisory for exact fixed versions.

Workarounds

Limit access to GPU device nodes to trusted users and processes using filesystem permissions and mandatory access control policies
Disable or restrict GPU compute workloads for non-privileged users where business requirements allow
Apply application allowlisting to prevent execution of untrusted binaries on affected devices

bash

# Restrict access to GPU device nodes to a trusted group
sudo groupadd gpu-trusted
sudo chown root:gpu-trusted /dev/dri/renderD*
sudo chmod 0660 /dev/dri/renderD*