CVE-2026-22163

CVE-2026-22163 describes an insufficient synchronization vulnerability (CWE-820) in an unspecified product's DDK kernel module. This flaw allows pre-existing malware to misuse the IOCTL interface, enabling the GPU to perform writes to arbitrary physical memory pages. Exploitation requires local access and the presence of malware, leading to a severe impact of arbitrary physical memory manipulation. Despite the critical potential impact, the vulnerability has an extremely low EPSS score of 0.00017, with no known active exploitation, public exploit code, or community attention. It is not listed on CISA's KEV catalog.