GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA)

GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems

GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices

GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation

GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference

GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries

GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical

GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR

GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak

GPU DDK - Improper locking when accessing the pvr_exp_fence object

GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet

GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)

GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet

GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem

GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count

GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)

GPU DDK - OOB read into fwlog due to unchecked block count

GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds

GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore

GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)

GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code

Possible kernel exceptions caused by reading and writing kernel heap data after free

GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`

GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

GPU DDK - SharedSecMem mapped into all GPU virtual address spaces

GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused

GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address

GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it

GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF

GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled

GPU DDK - rgxfw_hwperf_config OOB read & write

GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()

GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs

GPU DDK - psContext->eDM gives OOB write

GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory

GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex

GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet