Arm Valhall GPU EUVD-2026-72794

Exploitation requires the attacker to execute code as a local non-privileged user on a system running an affected Arm Valhall or 5th Gen GPU Kernel Driver (r29p0-r55p0 for Valhall; r41p0-r55p0 for 5th Gen). The attacker must be able to submit GPU workloads - either via a native application or through GPU compute APIs such as OpenCL or Vulkan - meaning the GPU driver must be accessible to user-space processes, which is the default configuration on Android. No network access is required and no elevated privileges are needed beyond a standard app sandbox or shell account. Exploitation is limited to devices with affected Arm GPU hardware (Valhall or 5th Gen Mali/Immortalis series); x86 or other GPU architectures are unaffected. Remote exploitation is not possible - the CVSS AV:N rating in the published score is inconsistent with the 'local non-privileged user process' description.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) is inconsistent with the description, which explicitly states exploitation requires a local non-privileged user process; the network attack vector and no-privilege ratings are almost certainly erroneous and should be AV:L/PR:L. This mismatch inflates the published score from what should be a ~5.5 (local, low-privilege, confidentiality-only) to 7.5, potentially distorting triaging decisions. EPSS is 0.14% (4th percentile), signaling no observed widespread exploitation, and there is no CISA KEV listing or reported POC. Even a mid-sized municipal IT team in mielec managing Android endpoint fleets should treat this as urgent primarily due to the OEM firmware update chain - the practical fix depends on SoC vendors (Samsung, MediaTek, Qualcomm-adjacent designs using Mali) shipping kernel driver updates, which historically lags Arm's upstream fix by months. SSVC exploitation status inferred as 'none' based on EPSS, and the technical impact, while serious (kernel memory disclosure), is limited to confidentiality with no integrity or availability impact.

An attacker who has installed a malicious application on an Android device - or who has local shell access - submits a crafted sequence of GPU memory operations through OpenCL or Vulkan compute APIs. The Valhall or 5th Gen GPU kernel driver processes these operations without proper isolation, returning kernel memory contents to the user-space process. The attacker iterates to extract sensitive kernel data such as KASLR offsets, cryptographic key material, or other process data residing in kernel memory, potentially facilitating further privilege escalation.