CVE-2026-12285: Arm Bifrost/Valhall GPU Kernel Driver use-after-free

CVE-2026-12285 · Severity: medium · CVSS 4 · Published 2026-09-08

Arm's GPU kernel drivers used in mobile and embedded devices contain a use-after-free vulnerability that allows local users to access freed memory during GPU operations. An attacker with local access could exploit this to read sensitive data or crash the GPU, potentially affecting the stability and security of systems relying on these drivers for graphics processing.

Technologies: Arm 5th Gen GPU Architecture Kernel Driver, Arm Bifrost GPU Kernel Driver, Arm Valhall GPU Kernel Driver. Vendors: Arm.

Quick answers

Is CVE-2026-12285 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12285 being exploited in the wild.
How severe is CVE-2026-12285?
Medium severity, with a CVSS score of 4, published 8 September 2026.
Which products and versions are affected?
Arm 5th Gen GPU Architecture Kernel Driver r41p0-r49p5, r50p0-r54p3, r55p0; Arm Bifrost GPU Kernel Driver r41p0-r49p5, r50p0-r51p0, r54p1-r54p2; Arm Valhall GPU Kernel Driver r41p0-r49p5, r50p0-r54p3, r55p0.
Is there a fix for CVE-2026-12285?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12285 attacked?
It is attacked with local access.
Am I affected by CVE-2026-12285?
Check whether you run Arm 5th Gen GPU Architecture Kernel Driver, Arm Bifrost GPU Kernel Driver or Arm Valhall GPU Kernel Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a use-after-free vulnerability in the memory management logic of three Arm GPU kernel drivers (Bifrost, Valhall, and 5th Gen Architecture). The vulnerability allows a local non-privileged user to issue valid GPU memory processing operations that reference memory that has already been freed. The attack requires local access to the system but does not require elevated privileges. By exploiting this, an attacker can potentially read freed memory contents or trigger a denial of service. Patches are available from Arm via the support documentation reference.

Affected products

  • Arm Bifrost GPU Kernel Driver r41p0-r49p5, r50p0-r51p0, r54p1-r54p2
  • Arm Valhall GPU Kernel Driver r41p0-r49p5, r50p0-r54p3, r55p0
  • Arm Arm 5th Gen GPU Architecture Kernel Driver r41p0-r49p5, r50p0-r54p3, r55p0

Timeline

  • 2026-09-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.