GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset

GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D

GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP

GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite

GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation

GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world

GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes

GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF

GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation

GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write

GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused

GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write

GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable

GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs

GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF

GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages

GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping

GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags

GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory

GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers

GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted

GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0

GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()

GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU

GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel

GPU DDK - Page UAF read in PMMETA_PROTECT heap memory

GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse

GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem

GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted

GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink

GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory

GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU

GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns

GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist

GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory

GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory

GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails

GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object

GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size

GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write

GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes

GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition

GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition

GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition

GPU DDK - Arbitrary write of read-only dmabuf

GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write

GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)

Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement

GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence