CVE-2026-22163
Imaginationtech Ddk 25.1 – 25.3
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-22163 is a high-severity Missing Synchronization (CWE-820) vulnerability in Imaginationtech Ddk. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22163 is a vulnerability in the DDK kernel module IOCTL interface of Imagination Technologies GPU drivers. It stems from a lack of synchronization for concurrent access to a shared resource (CWE-820), enabling malware to misuse the interface in an unsupported manner. This misuse subverts the GPU, allowing it to perform writes to arbitrary physical memory pages.
A local attacker with low privileges (PR:L) can exploit this vulnerability, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) with a changed scope (S:C), as indicated by the CVSS v3.1 score of 7.8. The attacker typically needs crafted malware to trigger the IOCTL misuse, leading to GPU subversion and arbitrary physical memory writes, potentially enabling full kernel compromise.
The primary advisory from Imagination Technologies, available at https://www.imaginationtech.com/gpu-driver-vulnerabilities/, provides details on affected versions and recommended mitigations or patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13836
Vulnerability Data
Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages. The product utilises a shared…
more
resource in a concurrent manner but does not attempt to synchronise access to the resource.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper concurrency controls and synchronization primitives during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing synchronization through concurrency testing.
Secure SDLC practices can mandate concurrency controls and synchronization primitives.
Application security requirements can specify thread-safety and locking mechanisms.
Secure architecture principles include proper synchronization for shared resources.
Secure coding standards directly require synchronization primitives to prevent race conditions.