Arbitrary physical-memory writes via freelist remapping

Improper GPU system-call handling in Imagination Technologies Graphics DDK 24.3 and earlier allows local users to write physical memory. A freelist GPU virtual address can be remapped to another reservation or physical-memory resource, directing GPU hardware writes to arbitrary physical pages. Exploitation requires locally installed software running as a non-privileged user on a system using the affected driver, and the resulting writes can corrupt kernel or other protected memory.