Arm Valhall GPU Driver EUVD-2026-72795

Exploitation requires a local non-privileged user process on a device running an affected Arm Valhall or 5th Gen GPU Architecture kernel driver (r50p0 through r54p3 or r55p0). The attacker must be able to submit GPU processing operations - standard capability for any Android app or local shell user with GPU access, requiring no special permissions. No network access is required (AV:L). No user interaction is needed (UI:N). Exploitation is limited to systems with the specific affected GPU hardware (Arm Mali Valhall-class or 5th Gen GPU) and unpatched driver revisions; devices with non-Arm GPUs or updated firmware are unaffected.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a locally-exploitable kernel driver flaw requiring only a low-privileged local account - a realistic attacker posture for any app-level execution on Android or a shell user on embedded Linux. The full C:H/I:H/A:H impact vector signals potential privilege escalation to kernel context, consistent with UAF in kernel drivers. In contrast, the EPSS score of 0.14% at the 4th percentile is very low, indicating no current exploitation trend in the wild, and there is no CISA KEV entry. No public POC is identified at time of analysis. Real-world priority should be elevated for devices in high-value environments (enterprise Android fleets, industrial embedded Arm SoCs) given the local-to-kernel escalation potential, but does not warrant emergency response absent exploitation evidence. OEM-dependent patch delivery (most affected devices receive GPU driver updates only via firmware OTA) is a meaningful deployment lag factor.

An attacker with a low-privileged local account or a malicious Android application (no special permissions required beyond GPU access) submits a crafted sequence of valid GPU processing operations that causes the driver to dereference a previously freed kernel memory object. By controlling the freed memory's contents through a heap spray or race, the attacker can achieve arbitrary kernel read/write, enabling privilege escalation to root or kernel code execution.