CVE-2026-34194: GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count

Synopsis

A use-after-free (UAF) vulnerability in the Imagination Technologies Graphics DDK allows a local, low-privileged user to trigger reads and writes to arbitrary physical memory pages by issuing crafted GPU system calls against a sparse memory mapping. The flaw lives in the DevmemIntChangeSparse function, where an incorrect virtual index count calculation causes the driver to reference the wrong physical memory due to implicit scaling mismatches between buffers of different sizes (AV:L, PR:L, UI:N). Successful exploitation lets an attacker corrupt or disclose arbitrary physical memory, which on typical systems means bypassing memory isolation between processes or crashing the kernel. A patched-image rebuild at fix versions 1.18 RTM and 23.2 RTM is available on HarborGuard for environments running an affected Graphics DDK version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed to issue the malicious GPU system calls.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability entirely through their own process without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors outside the attacker's control.

Blast Radius

• Attacker writes to arbitrary physical memory pages, allowing corruption of kernel data structures or memory belonging to other processes.
• Attacker can crash the affected system by overwriting critical kernel state, causing a denial of service.
• Integrity of persisted data is at risk if writeable physical pages back storage buffers or file-system caches used by other workloads.