CVE-2026-45203 is a TOCTOU race condition vulnerability (CWE-367) in the Imagination Technologies Graphics DDK. Kernel software inside a Host VM can exploit this flaw by posting improper commands to GPU firmware, triggering unauthorized memory writes outside the allowed memory range. The root cause is a race condition where a malicious driver modifies memory values after the firmware has validated them but before they are used, leading to potential compromise of system confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.8, indicating high severity. No patch or official remediation information is currently available, and no known exploits are reported in the wild.

Successful exploitation can result in unauthorized memory writes outside permitted ranges, potentially compromising system confidentiality, integrity, and availability. This could allow a malicious driver to escalate privileges or cause system instability within the host VM environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict kernel-level access to trusted drivers only and monitor for suspicious activity related to GPU command submissions. Avoid deploying untrusted or unverified drivers in environments using this Graphics DDK.