CVE-2026-22163CWE-820

GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU

High · published March 20, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.2
In the wild
Unconfirmed
What it is

Requires malware code to misuse the DDK kernel module IOCTL interface.

Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages.

The product utilises a shared resource in a concurrent manner but does not attempt to synchronise access to the resource.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00083 · 0.2th percentile
Weakness
CWE-820 · Missing Synchronization
Published
2026-03-20T22:52Z
EPSS history
Timeline
  • 20 MAR 22:52Z
    GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
    cvelistv5