EUVD-2026-72798
GHSA-77xw-jh9c-7m36
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged access on Mali-GPU device
-
DeliveryIssue valid GPU memory allocation and processing operations
-
ExploitTrigger use-after-free in kernel driver
-
ExecutionAccess freed kernel heap memory
-
PersistCorrupt kernel structures via dangling pointer
-
ImpactEscalate to kernel/root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local code execution with at least low-privilege user access (AV:L, PR:L) - a logged-in shell account on Linux or an installed app on Android is sufficient. The attacker must be able to invoke GPU memory processing operations via the Mali kernel driver, which is possible for any process with read/write access to the GPU device node (e.g., /dev/mali0), a permission granted by default to most user-space processes on Android. No elevated privileges, network reachability, special non-default configuration, or user interaction is required. Exploitation is constrained to systems physically equipped with Arm Bifrost, Valhall, or 5th Gen Mali GPU hardware running an affected driver version. Remote exploitation is not possible. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately models a local privilege escalation scenario: a low-privileged user account is sufficient, no user interaction is required, attack complexity is low, and the outcome is full system compromise. EPSS at 0.14% (4th percentile) indicates no current widespread exploitation tooling, consistent with the absence of a CISA KEV entry and no identified public POC. However, EPSS should not drive deprioritization here - Arm Mali GPU driver UAF bugs have been exploited in prior campaigns on Android (e.g., CVE-2021-28664, CVE-2022-38181 patterns), and the AC:L rating means exploitation is straightforward once a working trigger is identified. The broad affected version range - spanning multiple r4x and r5x milestones across three driver families - implies a very large installed base of vulnerable devices. The S:U (scope unchanged) metric is conservative; kernel-level UAF could in practice affect the hypervisor or trusted execution environment on some SoC configurations, though this is not confirmed by the advisory data. |
| Exploit ScenarioDerived | A local unprivileged user or an Android application issues a crafted sequence of valid GPU memory allocation and processing API calls through the affected Mali kernel driver. This sequence triggers the use-after-free condition, allowing the process to read from or write to freed kernel memory regions. The attacker then uses heap-spray or kernel structure corruption techniques to overwrite security-sensitive kernel data, ultimately escalating to kernel or root privileges - a technique well-documented in prior Arm Mali driver exploitation research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers enables a local unprivileged process to access deallocated kernel memory through valid GPU memory processing operations, resulting in full confidentiality, integrity, and availability compromise (CVSS C:H/I:H/A:H). The flaw spans broad version ranges across all three driver families from r44p0 through r54p3/r55p0, affecting a large population of devices built on Arm Mali GPU hardware. No active exploitation is confirmed at time of analysis (EPSS 0.14%, no CISA KEV listing), but UAF vulnerabilities in kernel-mode GPU drivers are a well-established and historically weaponized local privilege escalation vector on Android and Linux platforms.
RemediationAI
Upgrade to a driver release beyond the affected ranges per the Arm security advisory at https://support.arm.com/documentation/111552/1-0/. The exact first-fixed version number for each driver family is not enumerated in the available data and must be confirmed directly from that advisory. On Android devices, the fix is delivered through OEM kernel updates - apply the manufacturer's latest security patch as soon as available, and treat devices awaiting an OEM update as at elevated risk given the low-privilege local exploit path. Where driver updates cannot be deployed immediately, restricting access to the GPU device node (typically /dev/mali0 or equivalent) via filesystem permissions or SELinux deny rules limits exploitation to processes with explicit device access, at the cost of disabling GPU acceleration for unprivileged applications. Do not rely solely on the low EPSS score to defer patching - the attack complexity is low and prior Arm Mali UAF bugs have been exploited.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (Use After Free) occurs in Arm's Mali GPU kernel-mode drivers - Bifrost (targeting Mali-G series up through approximately G76), Valhall (Mali-G57 through G710 and variants), and the 5th Gen Architecture (Mali-G720, G925). Kernel drivers execute with elevated privileges in ring-0; when a GPU memory object is freed but a dangling reference remains accessible via user-space-triggered code paths, a subsequent dereference can corrupt kernel heap structures or expose sensitive kernel data. The vulnerability is reachable through 'valid GPU memory processing operations', meaning ordinary GPU API calls rather than an exotic or privileged path, making the trigger accessible to any process holding access to the GPU device node. Affected CPEs cover cpe:2.3:a:arm_ltd:bifrost_gpu_kernel_driver, cpe:2.3:a:arm_ltd:valhall_gpu_kernel_driver, and cpe:2.3:a:arm_ltd:arm_5th_gen_gpu_architecture_kernel_driver across the stated version ranges.
Know when Bifrost Gpu Kernel Driver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local non-privileged user triggers kernel UAF via ordinary GPU calls with no UI interaction; full kernel compromise achievable.
Primary rating from Vendor (Arm).
CVSS VectorVendor: Arm
Lifecycle Timeline
3DescriptionCVE.org
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p4, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3, r55p0.
Executive ViewAI
Arm Mali GPU kernel drivers (Bifrost, Valhall, and 5th Gen architectures, versions r44p0 through r55p0) contain a use-after-free vulnerability allowing any local user to gain full system control without additional privileges. The flaw affects a large installed base of Android devices and Linux systems; no patch is currently available, creating an unpatched local privilege escalation risk across the organization's device ecosystem.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict GPU access via containerization or mandatory access controls (AppArmor, SELinux), disable non-essential GPU features operationally, isolate high-risk workloads to separate hardware, implement privilege-escalation detection and monitoring, enforce strict local-access controls and account isolation. Escalate to Arm Security for patch timeline and advisory updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Bifrost Gpu Kernel Driver
View allThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are m
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 b
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 throu
. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch ava
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivi
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows a local non-privileged proc
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge
A security vulnerability in Arm Ltd Bifrost GPU Kernel Driver (CVSS 7.8) that allows a local non-privileged user process
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge
Exploit-DB