Answer in brief
CVE-2026-45197 records a Low severity (CVSS 2.5) vulnerability in GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet. The current sources do not mark it as known exploited. The current feed maps Imagination Technologies/Graphics DDK (generic), Imagination Technologies/Graphics DDK (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Imagination Technologies/Graphics DDK (generic), Imagination Technologies/Graphics DDK (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Imagination Technologies/Graphics DDKgeneric | 1.18 RTM2 || 23.2 RTM2 || 24.2 RTM2 || 25.1 RTM2 || 26.1 RTM1 | Not reported |
| Imagination Technologies/Graphics DDKgeneric | 1.18 RTM2 || 23.2 RTM2 || 24.2 RTM2 || >=25.1 RTM2 <=25.3 RTM || 26.1 RTM1 | Not reported |
Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 4, 2026
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.
Quoted source text, attributed separately from HOL analysis.