CVE-2026-45197: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in Imagination Technologies Graphics DDK

This vulnerability involves a TOCTOU race condition in the GPU Firmware used by Imagination Technologies Graphics DDK. Kernel software inside a Guest VM can send commands that cause the firmware to access memory outside the Guest's allocated virtual GPU memory. Although the firmware validates the data before use, the TOCTOU bug allows the validation results to be invalidated before the memory access occurs, leading to potential unauthorized memory reads or writes.

The impact is limited to a low severity level with a CVSS score of 2.5. The vulnerability allows a local attacker with low privileges inside a Guest VM to cause the GPU Firmware to read or write outside the Guest's virtualized GPU memory. There is no indication of privilege escalation, denial of service, or remote exploitation. No known exploits are reported in the wild.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict untrusted kernel code execution inside Guest VMs and monitor for unusual GPU command activity if possible.