CVE-2026-45195CWE-280

GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted

High · published June 26, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.

Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2026-06-26T15:18Z
EPSS history
Timeline
  • 26 JUN 15:18Z
    GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
    cvelistv5