An out of bounds memory access vulnerability in the Linux kernel Imagination GPU driver allows a local authenticated attacker to potentially compromise system confidentiality and availability.

This vulnerability occurs in the pvr_set_uobj_array function within the drm/imagination driver. The function improperly calculates memory offsets when copying objects to userspace, leading to incorrect pointer arithmetic. An attacker with local, low-privileged access can exploit this flaw to read sensitive kernel memory or trigger a system crash.

The vulnerability carries a CVSS score of 7.1, reflecting a high risk to system integrity and stability. Successful exploitation allows a local user to bypass memory isolation boundaries, potentially leading to the leakage of sensitive kernel data or denial of service through system instability. While access is limited to local authenticated users, the ability to read kernel memory poses a significant threat in multi-tenant environments or shared computing systems.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or a later stable release where this issue is resolved.

Proactive Monitoring: Monitor system logs for repeated kernel crashes or unusual memory access errors associated with the drm/imagination driver module.

Compensating Controls: Restrict access to the system to authorized users only and consider disabling the PowerVR (imagination) GPU driver if it is not required for specific hardware tasks.

Public Exploit Available: Unknown

The severity of this kernel-level vulnerability warrants prompt attention for systems utilizing the Imagination GPU driver. Administrators should prioritize patching the kernel to the recommended versions to eliminate the risk of unauthorized kernel memory access. Given the potential for system instability and information disclosure, testing and deployment of these kernel updates should be performed during the next scheduled maintenance window.