Executive brief
Arm GPU userspace drivers used in mobile and embedded devices contain a use-after-free vulnerability that allows an unprivileged user to access freed memory through valid GPU processing operations initiated via WebGL or WebGPU. An attacker could exploit this to read sensitive data, cause a denial of service, or potentially execute code, impacting device security and stability.
Technical details
A use-after-free vulnerability exists in the Bifrost, Valhall, and 5th Gen GPU architecture userspace drivers. The vulnerability is triggered when a non-privileged process submits valid GPU processing operations (including through WebGL or WebGPU interfaces), which reference memory that has already been freed. No special privileges are required to trigger the flaw. An attacker can read freed memory contents or cause memory corruption, potentially leading to information disclosure or denial of service. Patches are available for affected version ranges.
Affected products
- Arm Bifrost GPU Userspace Driver r42p0 through r49p5, r50p0 through r51p0, r54p1 through r54p3
- Arm Valhall GPU Userspace Driver r42p0 through r49p5, r50p0 through r54p3, r55p0
- Arm 5th Gen GPU Architecture Userspace Driver r42p0 through r49p5, r50p0 through r54p3, r55p0
Timeline
- 2026-09-08: disclosed: Vulnerability published on NVD