PatchTheCVECVE-2026-22167: Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to writ
CVE-2026-22167 is a high-severity flaw (CVSS 7.8) affecting ddk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. This attack can lead the GPU to perform write operations on restricted internal GPU buf
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 96%) |
| CISA exploited list | No |
| Weakness | CWE-119 |
| Published | 2026-05-01 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-22167?
ddk: upgrade to newer than 25.2. Exact commands for each OS are on this page.
Is CVE-2026-22167 being exploited?
CVE-2026-22167 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-22167 affect?
CVE-2026-22167 affects ddk. Severity is high (CVSS 7.8). Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocate
How urgent is CVE-2026-22167?
Priority 28/100. High severity
Related CVEs
- CVE-2026-22166 HIGH 8.1 UPGRADE A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write
- CVE-2026-22165 HIGH 8.1 UPGRADE A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a writ
- CVE-2026-21733 HIGH 7.3 UPGRADE Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permis
- CVE-2026-21734 HIGH 7.7 UPGRADE A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a wri
- CVE-2026-45195 HIGH 7.8 UPGRADE Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigg