CVE-2026-7477: Arm Bifrost, Valhall, and 5th Gen GPU Kernel Driver use-after-free

CVE-2026-7477 · Severity: high · CVSS 7.8 · Published 2026-09-08

Arm's GPU kernel drivers (used in mobile and embedded devices) contain a use-after-free vulnerability that allows a local user to access freed GPU memory through specially crafted GPU operations. An attacker with local access could potentially read sensitive data from GPU memory, crash the GPU driver, or execute code with kernel privileges, affecting device stability and security.

Quick answers

Is CVE-2026-7477 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7477 being exploited in the wild.
How severe is CVE-2026-7477?
High severity, with a CVSS score of 7.8, published 8 September 2026.
Which products and versions are affected?
Arm Ltd Bifrost GPU Kernel Driver r44p0 through r49p4, r50p0 through r51p0, r54p1 through r54p2; Arm Ltd Valhall GPU Kernel Driver r44p0 through r49p5, r50p0 through r54p3; Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver r44p0 through r49p5, r50p0 through r54p3, r55p0.
Is there a fix for CVE-2026-7477?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7477 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-7477?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a use-after-free vulnerability in GPU memory handling within three Arm kernel drivers: Bifrost, Valhall, and Arm 5th Gen GPU Architecture. A local non-privileged user process can craft valid GPU memory operations to reference and access memory regions that have already been freed, bypassing memory safety protections. The vulnerability affects multiple version ranges across all three drivers. Exploitation requires local access and the ability to submit GPU operations, but does not require elevated privileges. An attacker can read freed memory contents, potentially leaking sensitive kernel or GPU driver data, or trigger use-after-free conditions leading to kernel panic or code execution.

Affected products

  • Arm Ltd Bifrost GPU Kernel Driver r44p0 through r49p4, r50p0 through r51p0, r54p1 through r54p2
  • Arm Ltd Valhall GPU Kernel Driver r44p0 through r49p5, r50p0 through r54p3
  • Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver r44p0 through r49p5, r50p0 through r54p3, r55p0

Timeline

  • 2026-09-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.