SB2026090930 - Multiple vulnerabilities in PowerVR GPU DDK

Description

This security bulletin contains information about 4 vulnerabilities.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-45197)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read or write data outside the guest\'s virtualized GPU memory.

The vulnerability exists due to a time-of-check to time-of-use race condition in psFWMemContext->uiPageCatBaseRegSet when processing commands sent to the GPU firmware by kernel software running inside a guest VM. A local privileged user can post improper commands to the GPU firmware to read or write data outside the guest\'s virtualized GPU memory.

2) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the libusc.so GPU shader compiler library during the early optimisation pass when processing unusual GPU shader code from a web page. A remote attacker can provide a web page containing unusual GPU shader code to cause a denial of service.

On certain platforms, the shader compiler process runs with system privileges.

3) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: N/A)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose past data.

The vulnerability exists due to improper cache cleaning in PhysmemWrapExtMem when mapping imported pages uncached. A local user can cause the GPU to read imported pages with stale cache contents to disclose past data.

4) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the GPU GLES render process when processing unusual WebGPU content. A remote attacker can load a web page containing unusual WebGPU content to terminate the render process unexpectedly.

Remediation

Install update from vendor's website.

References

• https://www.imaginationtech.com/gpu-driver-vulnerabilities/#PSP-518
• https://www.imaginationtech.com/gpu-driver-vulnerabilities/#PSP-665
• https://www.imaginationtech.com/gpu-driver-vulnerabilities/#PSP-517
• https://www.imaginationtech.com/gpu-driver-vulnerabilities/#PSP-696