VulnerabilityDeferred

CVE-2026-45198

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.

HIGH 7.8EPSS 0.12%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.12% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-822
Source: 367425dc-4d06-4041-9650-c2dc6aaa27ce

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.