Executive brief
Arm's GPU kernel drivers used in mobile and embedded devices contain a use-after-free vulnerability that allows local users to access freed memory during GPU operations. An attacker with local access could exploit this to read sensitive data or crash the GPU, potentially affecting the stability and security of systems relying on these drivers for graphics processing.
Technical details
This is a use-after-free vulnerability in the memory management logic of three Arm GPU kernel drivers (Bifrost, Valhall, and 5th Gen Architecture). The vulnerability allows a local non-privileged user to issue valid GPU memory processing operations that reference memory that has already been freed. The attack requires local access to the system but does not require elevated privileges. By exploiting this, an attacker can potentially read freed memory contents or trigger a denial of service. Patches are available from Arm via the support documentation reference.
Affected products
- Arm Bifrost GPU Kernel Driver r41p0-r49p5, r50p0-r51p0, r54p1-r54p2
- Arm Valhall GPU Kernel Driver r41p0-r49p5, r50p0-r54p3, r55p0
- Arm Arm 5th Gen GPU Architecture Kernel Driver r41p0-r49p5, r50p0-r54p3, r55p0
Timeline
- 2026-09-08: disclosed