CVE-2026-45195: GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you run GPU DDK/firmware in a Host VM setup, isolate the VM/kernel software that can issue GPU commands so that untrusted or guest-controlled workloads cannot post improper commands to the GPU Firmware to trigger out-of-range GPU memory reads/writes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45195?
CVE-2026-45195 has a risk score of 54, indicating a moderate severity level.
How do I fix CVE-2026-45195?
To fix CVE-2026-45195, ensure that you apply the latest firmware updates from your GPU vendor that address this vulnerability.
What systems are affected by CVE-2026-45195?
CVE-2026-45195 affects systems running the GPU DDK inside a Host VM where improper commands may be posted to the GPU Firmware.
What types of vulnerabilities are associated with CVE-2026-45195?
CVE-2026-45195 is associated with potential memory access violations that can lead to unauthorized memory reads or writes.
Why is CVE-2026-45195 a concern for virtualization environments?
CVE-2026-45195 is concerning for virtualization environments because it allows kernel software within a VM to potentially execute privileged operations on the host.