EUVD-2026-72795
GHSA-5pq5-p4p5-8pfg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local non-privileged execution
-
DeliverySubmit crafted GPU processing operations
-
ExploitTrigger use-after-free in kernel driver
-
ExecutionAccess freed kernel memory
-
PersistAchieve arbitrary kernel read/write
-
ImpactEscalate to root or kernel code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local non-privileged user process on a device running an affected Arm Valhall or 5th Gen GPU Architecture kernel driver (r50p0 through r54p3 or r55p0). The attacker must be able to submit GPU processing operations - standard capability for any Android app or local shell user with GPU access, requiring no special permissions. No network access is required (AV:L). No user interaction is needed (UI:N). Exploitation is limited to systems with the specific affected GPU hardware (Arm Mali Valhall-class or 5th Gen GPU) and unpatched driver revisions; devices with non-Arm GPUs or updated firmware are unaffected. |
| Impact | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a locally-exploitable kernel driver flaw requiring only a low-privileged local account - a realistic attacker posture for any app-level execution on Android or a shell user on embedded Linux. The full C:H/I:H/A:H impact vector signals potential privilege escalation to kernel context, consistent with UAF in kernel drivers. In contrast, the EPSS score of 0.14% at the 4th percentile is very low, indicating no current exploitation trend in the wild, and there is no CISA KEV entry. No public POC is identified at time of analysis. Real-world priority should be elevated for devices in high-value environments (enterprise Android fleets, industrial embedded Arm SoCs) given the local-to-kernel escalation potential, but does not warrant emergency response absent exploitation evidence. OEM-dependent patch delivery (most affected devices receive GPU driver updates only via firmware OTA) is a meaningful deployment lag factor. |
| Exploit ScenarioDerived | An attacker with a low-privileged local account or a malicious Android application (no special permissions required beyond GPU access) submits a crafted sequence of valid GPU processing operations that causes the driver to dereference a previously freed kernel memory object. By controlling the freed memory's contents through a heap spray or race, the attacker can achieve arbitrary kernel read/write, enabling privilege escalation to root or kernel code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Use-after-free in Arm's Valhall and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed kernel memory by submitting valid GPU processing operations, with potential for full system compromise across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H). Both driver families are affected from r50p0 through r54p3 and at r55p0, covering a wide swath of devices - notably Android smartphones and embedded SoCs - that rely on these GPU drivers. No active exploitation is confirmed (EPSS 0.14%, 4th percentile; no CISA KEV listing) at time of analysis.
RemediationAI
Upgrade to a driver revision beyond the affected range - revisions after r55p0 (i.e., r55p1 or later) or a patched r54p4+ branch per Arm's advisory at https://support.arm.com/documentation/111552/1-0/?lang=en; the exact first fixed version is not independently confirmed from available data and should be verified against the Arm advisory. For Android end-user devices, GPU driver updates are delivered exclusively through OEM firmware OTAs; device owners should apply the latest vendor-supplied OS/firmware update and monitor OEM security bulletin cadence. For embedded Linux deployments integrating Arm Mali GPU IP directly, update the kernel driver source to the patched revision from Arm's partner repositories. As a compensating control where patching is not immediately feasible, restricting untrusted local user access (e.g., disabling shell access, confining GPU-using processes via SELinux/AppArmor mandatory access control) reduces the attack surface, though it does not eliminate the underlying flaw.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-416 Use After Free in the kernel-mode GPU driver components for Arm's Valhall architecture (Mali-G series, e.g., Mali-G710/G610) and the 5th Gen GPU Architecture line. GPU kernel drivers operate at ring-0 and manage memory allocation for GPU command processing submitted from userspace. When a memory object is freed but a reference is retained and later dereferenced during GPU operation dispatch, the freed region can be reused by another allocation - enabling a userspace process to read or write arbitrary kernel memory. CPE strings confirm both cpe:2.3:a:arm_ltd:valhall_gpu_kernel_driver and cpe:2.3:a:arm_ltd:arm_5th_gen_gpu_architecture_kernel_driver are affected across the r50p0-r54p3 and r55p0 revision range. These drivers are widely shipped in Android OEM firmware from manufacturers using Arm Mali IP.
Know when Valhall Gpu Kernel Driver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel driver UAF exploitable by any low-privileged process with GPU access; no user interaction needed; full kernel compromise possible.
Primary rating from Vendor (Arm).
CVSS VectorVendor: Arm
Lifecycle Timeline
3DescriptionCVE.org
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to access already freed memory.
This issue affects Valhall GPU Kernel Driver: from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r50p0 through r54p3, r55p0.
Executive ViewAI
Arm's Valhall and 5th Generation GPU kernel drivers contain a use-after-free vulnerability affecting millions of Android smartphones and embedded systems, with no vendor patch currently available. The flaw allows unprivileged local attackers to access freed kernel memory through GPU operations, creating potential for complete system compromise. Organizations managing Android device fleets or Arm-based IoT and embedded infrastructure face unmitigated exposure until vendor remediation is released.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict physical and local network access to affected devices; disable GPU acceleration features where operationally feasible; implement strict access controls and logging of process execution on affected systems; prioritize deployment of any firmware or driver updates available from device manufacturers; and apply network segmentation to limit lateral movement if local compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Valhall Gpu Kernel Driver
View allThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are m
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge
Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-aft
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 b
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 throu
An issue was discovered in the Arm Mali GPU Kernel Driver. Rated high severity (CVSS 8.8), this vulnerability is remotel
An issue was discovered in the Arm Mali GPU Kernel Driver. Rated high severity (CVSS 8.8), this vulnerability is remotel
. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch ava
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivi
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers enables a local unprivileged proce
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows a local non-privileged proc
Exploit-DB