CVE-2026-45201: GPU System Call Privilege Escalation Vulnerability

CVE-2026-45201 Overview

CVE-2026-45201 is an out-of-bounds read and write vulnerability in Imagination Technologies GPU drivers. A local, non-privileged user can issue crafted GPU system calls that pass an invalid log2 page size when allocating physical pages. The driver fails to validate this value, allowing 4K pages to be treated as higher-order pages. This mismatch grants read and write access to memory beyond the intended 4K boundary. The flaw is tracked under CWE-1284: Improper Validation of Specified Quantity in Input.

Critical Impact
A local attacker with low privileges can achieve out-of-bounds memory access in the GPU driver, potentially leading to kernel memory corruption and privilege escalation.

Affected Products

Imagination Technologies GPU DDK (Driver Development Kit)
Devices shipping PowerVR and IMG GPU drivers derived from the affected DDK
Downstream System-on-Chip vendors integrating the vulnerable driver stack

Discovery Timeline

2026-08-21 - CVE-2026-45201 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-45201

Vulnerability Analysis

The vulnerability resides in the GPU driver path that handles physical page allocation requests originating from user space. The kernel-side handler accepts a log2 page size parameter supplied by the calling process. This parameter tells the driver how large each allocated page block should be, expressed as a power of two.

The driver does not properly validate the supplied log2 value against expected bounds. When an attacker supplies a crafted value, the driver miscalculates memory extents. Pages backed by 4K physical allocations get treated as if they were higher-order pages spanning larger regions.

Subsequent read and write operations that trust the incorrect size metadata reach beyond the actual 4K allocation. This produces out-of-bounds memory access in kernel context, where GPU drivers execute.

Root Cause

The root cause is improper validation of a user-supplied quantity, classified under CWE-1284. The GPU system call interface trusts the log2 page size input without ensuring it corresponds to a physically valid allocation order. Trust boundary violation between unprivileged callers and the kernel driver enables the primitive.

Attack Vector

Exploitation requires local access with the ability to run non-privileged software that can issue GPU ioctls or equivalent system calls. No user interaction beyond running the malicious process is needed. The attacker crafts allocation requests with an inconsistent log2 page size and then triggers driver operations that use the corrupted size, producing arbitrary out-of-bounds reads or writes.

See the Imagination Technologies GPU Vulnerabilities advisory for vendor-specific technical details.

Detection Methods for CVE-2026-45201

Indicators of Compromise

Unprivileged processes issuing high-frequency or malformed GPU allocation ioctls to PowerVR or IMG GPU device nodes such as /dev/dri/* or vendor-specific character devices.
Kernel log entries referencing GPU driver faults, page table inconsistencies, or unexpected allocation orders shortly after user-space GPU activity.
Unexplained crashes or memory corruption in kernel components adjacent to GPU driver memory regions.

Detection Strategies

Monitor process telemetry for non-privileged binaries opening GPU device files and invoking allocation-related ioctls at abnormal rates.
Correlate kernel oops and panic events with the preceding user-space process tree to identify attempted exploitation.
Baseline legitimate GPU workloads for each device class so anomalous allocation patterns from untrusted processes stand out.

Monitoring Recommendations

Ingest kernel ring buffer logs (dmesg, journalctl -k) into a central SIEM and alert on GPU driver error signatures.
Track privilege transitions and new root-owned processes spawned from contexts that previously accessed GPU device nodes.
Enable audit rules on GPU device file access to build a traceable record of which users and binaries interact with the driver.

How to Mitigate CVE-2026-45201

Immediate Actions Required

Inventory devices running Imagination Technologies GPU drivers and identify the DDK version each ships.
Apply the vendor-supplied driver update as soon as it is available from the device or SoC manufacturer.
Restrict local access on affected systems, particularly multi-tenant hosts, shared workstations, and Android or embedded devices with untrusted app installation.

Patch Information

Imagination Technologies publishes affected DDK versions and fixed releases on the Imagination Technologies GPU Vulnerabilities page. Downstream vendors must integrate the corrected DDK into their board support packages and ship firmware or OS updates to end users. Consult the specific device vendor for platform-specific patch timelines.

Workarounds

Limit which local users and applications can open GPU device nodes by tightening file permissions and Linux capabilities on the relevant /dev entries where operationally feasible.
On managed endpoints, block installation and execution of untrusted binaries that could invoke GPU ioctls from non-privileged contexts.
Where GPU acceleration is not required, disable or unload the affected driver until a patched version is deployed.

bash

# Example: restrict GPU device access to a trusted group only
sudo groupadd gpu-trusted
sudo chown root:gpu-trusted /dev/dri/renderD128
sudo chmod 660 /dev/dri/renderD128
# Add only vetted service accounts to the gpu-trusted group
sudo usermod -aG gpu-trusted <trusted-user>