GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF

GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused

GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write

GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable

GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs

GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF

GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages

GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0

GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()

GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU

GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel

GPU DDK - Page UAF read in PMMETA_PROTECT heap memory

GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse

GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem

GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted

GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory

GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU

GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns

GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory

In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper input validation

GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation

GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR

GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak

GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet

GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)

In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition