Arm GPU Kernel Driver EUVD-2026-72793

The attacker must have local unprivileged code execution on a device whose GPU kernel driver falls within the affected version ranges for Bifrost, Valhall, or Arm 5th Gen architecture. Exploitation requires the ability to make GPU memory processing API calls, which is standard for any application on Android or Linux systems with Mali GPU access - no special privilege or non-default configuration is needed beyond running code on the affected device. The CVSS vector (AV:L/PR:L) confirms that network-reachable or unauthenticated remote exploitation is not possible; an attacker must already be executing code on the target system. Exploitation is not automatable per SSVC, meaning a tailored sequence of GPU operations is needed rather than a fire-and-forget payload.

CVSS 3.1 scores this at 4.4 (Medium), reflecting AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - a local, low-complexity, low-privilege attack with limited impact and no scope change. SSVC corroborates the restrained picture: exploitation is rated 'none,' the attack is not automatable (requires direct local process interaction with the GPU), and technical impact is 'partial.' No KEV listing, no public proof-of-concept, and no EPSS score is provided, meaning real-world exploitation probability cannot be independently quantified. The CVSS Availability score of N conflicts with the 'Denial Of Service' tag in the input metadata; the vendor's own advisory rates A:N, and the description describes memory access, not a crash path - the DoS tag appears to be an error. While UAF in a kernel driver carries theoretical escalation risk, the vendor's CVSS and scope-unchanged assessment suggest the freed memory region is bounded within the driver's own allocations rather than arbitrary kernel memory. This is a credible but low-urgency vulnerability: patch during normal maintenance cycles; no evidence of active exploitation warrants emergency response.

An unprivileged application running on an Android or embedded Linux device with an Arm Bifrost, Valhall, or 5th Gen Mali GPU issues a sequence of GPU memory operations that causes the kernel driver to free a memory region while retaining a live reference to it. A subsequent valid GPU processing call then dereferences the stale pointer, allowing the application to read or modify the contents of the freed memory region - which may contain residual data from prior GPU workloads of other processes. No public proof-of-concept has been identified, and exploitation requires local code execution on the target device.