CVE-2026-34195: GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes

Synopsis

A kernel heap out-of-bounds write vulnerability exists in the Imagination Technologies Graphics DDK, specifically in the PMRChangeSparseMemOSMem function. It is reachable over the network by any low-privileged user and requires no victim interaction. Successful exploitation gives an attacker full read and write access to kernel memory and can crash the affected service. A patched-image rebuild at fix versions 1.18 RTM, 23.2 RTM, 26.1 RTM, and 26.2 RTM is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected service must be reachable over the network; the CVSS vector specifies AV:N, meaning an attacker initiates the exploit remotely.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account; the CVSS vector specifies PR:L, so any standard user credential is sufficient.

• Victim interactionNot required

  No user action or social engineering is needed; the CVSS vector specifies UI:N, so the attacker triggers the vulnerability entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the CVSS vector specifies AC:L, meaning no race conditions or specific memory layouts are required.

Blast Radius

• Reads arbitrary kernel memory, exposing sensitive data such as credentials, cryptographic keys, and other processes' memory contents.
• Writes arbitrary data into kernel heap memory, allowing the attacker to overwrite kernel structures and escalate privileges or inject malicious code.
• Crashes the affected kernel driver or the host system, causing a denial of service for all workloads sharing that node.
• Combines confidentiality and integrity compromise to enable persistent kernel-level access to the affected host.