CVE-2026-99004

What it actually does

Integer underflow in device-virtual page table preallocation size calculation within drm/imagination allows a mapping crossing a page table boundary to request a huge number of MMU pages, exhausting memory and triggering an OOM panic.

Why it matters to the business

Systems using Imagination/PowerVR GPUs may experience sudden kernel panics and memory exhaustion from local GPU mapping operations, causing denial of service; the issue is only two days old with low exploit maturity so immediate operational impact is limited but kernel updates remain necessary.

How an attack unfolds

An attacker with access to the GPU mapping interface supplies a device address range that crosses a page table boundary, causing the index difference calculation to underflow and request an enormous quantity of MMU pages that exhausts system memory.

How to fix it

Update the Linux kernel to a version containing commit 0a8224058a58 and the follow-on fix that counts tables from device_addr using an inclusive end; rebuild and reboot with the corrected driver.

How to confirm the fix worked

Confirm the presence of the corrected page table sizing logic in pvr_mmu_op_context_create by inspecting kernel source or running targeted mapping tests that previously caused underflow; verify no excessive MMU page allocations occur on boundary-crossing ranges.

Typical attack path

1. Obtain local access to a system with the vulnerable drm/imagination driver
2. Issue a GPU device mapping request via the map() interface that spans a page table boundary
3. Trigger the underflow in page table index difference inside pvr_mmu_op_context_create
4. Force massive MMU page preallocation leading to OOM panic

How to detect it

Search kernel logs and dmesg for OOM killer invocations or panic messages referencing excessive MMU page allocations or pvr_mmu_op_context_create; correlate with GPU mapping syscalls from untrusted processes.

What your security team should do

• Prioritize kernel updates for any hosts exposing Imagination GPUs to untrusted local processes
• Review logs for recent OOM events involving drm or pvr_mmu after applying the fix
• Limit unprivileged access to GPU device nodes until patches are deployed