CVE-2026-41158: GPU Driver Use-After-Free Vulnerability

CVE-2026-41158 Overview

CVE-2026-41158 is a use-after-free vulnerability [CWE-416] affecting Imagination Technologies GPU drivers. A non-privileged local user can issue GPU system calls that write to physical memory pages already freed by the kernel module. The driver allocates and frees physical memory without using a deferred free mechanism, allowing the GPU to retain read and write access to those pages after they have been returned to the system.

An attacker who reuses freed pages can corrupt kernel data, escalate privileges, or compromise system integrity from an unprivileged user context.

Critical Impact
A local low-privileged user can leverage GPU system calls to read or write arbitrary freed physical pages, leading to kernel memory corruption and likely privilege escalation on affected devices.

Affected Products

Imagination Technologies GPU drivers (specific affected versions not enumerated in the CVE record)
Systems integrating Imagination Tech GPU kernel modules
Mobile and embedded platforms shipping affected PowerVR/Imagination GPU stacks

Discovery Timeline

2026-06-12 - CVE-2026-41158 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-41158

Vulnerability Analysis

The flaw resides in the GPU kernel module's physical memory management path. When the driver frees physical pages, it does not employ a deferred free mechanism to ensure the GPU has finished referencing those pages. The GPU's memory management unit (MMU) may still hold mappings to the freed pages, allowing in-flight or subsequently issued GPU commands to perform read and write operations against memory that the kernel has reclaimed.

Once the kernel reallocates those physical pages for other purposes, including kernel data structures, page tables, or other processes' memory, the GPU continues to write into them. This produces a classic use-after-free condition [CWE-416] with the unusual property that the dangling reference is held by the GPU rather than by CPU-side code.

Root Cause

The root cause is the absence of synchronization between the GPU's MMU state and the kernel's physical page allocator. The driver returns pages to the system before invalidating GPU mappings and before confirming that all outstanding GPU work referencing those pages has completed. Deferred free semantics, which delay page release until the GPU has quiesced, are not enforced on the affected allocation path.

Attack Vector

Exploitation requires only local access with low privileges and no user interaction. An attacker installs and runs unprivileged code that issues GPU system calls to allocate memory, trigger a free, and then submit GPU commands referencing the stale mappings. By spraying kernel allocations after the free, the attacker steers sensitive kernel objects into the reclaimed pages and overwrites them through the GPU. Successful exploitation yields high impact on confidentiality, integrity, and availability.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Imagination Tech GPU Vulnerabilities advisory.

Detection Methods for CVE-2026-41158

Indicators of Compromise

Unexpected kernel panics, oops messages, or memory corruption traces originating from GPU driver code paths
Unprivileged processes issuing high volumes of GPU ioctl calls combined with rapid allocation and free cycles
Anomalous kernel symbol corruption or credential structure modifications following GPU workload bursts

Detection Strategies

Monitor kernel logs for GPU driver faults, MMU page-fault messages, and unexpected references to freed physical addresses
Apply kernel address sanitizer (KASAN) or comparable memory-safety instrumentation in test environments to catch use-after-free against GPU-managed pages
Alert on local privilege escalation patterns where a non-privileged process gains root or kernel-level capabilities shortly after heavy GPU activity

Monitoring Recommendations

Track GPU driver versions across the fleet and flag devices running unpatched Imagination GPU kernel modules
Audit which unprivileged users and applications hold access to GPU device nodes such as /dev/dri/* and vendor-specific GPU character devices
Correlate GPU subsystem errors with subsequent process privilege changes to surface exploitation attempts

How to Mitigate CVE-2026-41158

Immediate Actions Required

Inventory all systems using Imagination Technologies GPU drivers and identify those running affected kernel module versions
Apply vendor-supplied driver updates from device manufacturers as soon as they are made available downstream
Restrict access to GPU device nodes to trusted users and reduce the attack surface for non-privileged accounts

Patch Information

Imagination Technologies has published advisory information covering this and related GPU driver issues at the Imagination Tech GPU Vulnerabilities page. Patched driver releases must be integrated by SoC vendors and device OEMs, then delivered through platform firmware or operating system updates. Verify with your device vendor that the deployed driver build incorporates the fix that enables deferred free semantics for GPU physical page allocations.

Workarounds

Limit execution of untrusted local code on affected devices until patched drivers are deployed
Where feasible, disable or restrict GPU compute interfaces for non-privileged users through device-node permissions and mandatory access control policies
Enforce application allow-listing on embedded and mobile devices to block unknown binaries from issuing GPU system calls

bash

# Restrict GPU device node access to a trusted group
sudo chgrp gpu-trusted /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128

# Verify current driver version (example for PowerVR/Imagination stack)
cat /sys/module/pvrsrvkm/version 2>/dev/null || dmesg | grep -i pvrsrv