CVE-2025-58410CWE-280

CVE-2025-58410

High · published November 17, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

⚡ A non-privileged user could unleash some serious GPU mischief with a single call — improper memory protections are at play! 🔥 Think of it like a sneaky chef who found a way to access the kitchen’s exclusive ingredients, despite only being allowed to use shelf-stable items. Suddenly, they can create gourmet dishes with high-grade supplies they shouldn't even touch! This vulnerability can allow an attacker to gain unwarranted write permissions to memory buffers that should be read-only. If exploited, this could lead to unauthorized data manipulation or even system crashes—an absolute nightmare for any system administrator!

Put simply

Think of it like a sneaky chef who found a way to access the kitchen’s exclusive ingredients, despite only being allowed to use shelf-stable items. Suddenly, they can create gourmet dishes with high-grade supplies they shouldn't even touch! CVE-2025-58410 arises from improper handling of memory protections on GPU buffer resources, letting users circumvent restrictions meant to guard sensitive data. This issue occurs when software runs as a non-privileged user but makes improper GPU system calls.

What to do

This vulnerability can allow an attacker to gain unwarranted write permissions to memory buffers that should be read-only. If exploited, this could lead to unauthorized data manipulation or even system crashes—an absolute nightmare for any system administrator! To fix this, ensure you update to the latest version where this vulnerability has been patched. Review all GPU system calls and implement stricter memory protection protocols to prevent unauthorized access. Regular security audits can also help catch these issues before they escalate! You've got this! Stay proactive and secure your systems—let's keep the bad guys at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2025-11-17T22:15Z
Affected products (9)
ProductVersionsFixed in
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
imaginationtech/ddkall versions—
References (1)
EPSS history
Timeline
  • 17 NOV 16:57Z
    GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
    cvelistv5