CVE-2026-0001: CWE-416 Use After Free in Arm Ltd Bifrost GPU Kernel Driver

This vulnerability (CWE-416) exists in the Arm Ltd Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, and Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can exploit this flaw by performing valid GPU memory processing operations to access memory that has already been freed, potentially leading to undefined behavior or security issues. The affected versions include Bifrost GPU Kernel Driver from r41p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. There is no CVSS score or vendor advisory patch information available at this time.

The vulnerability allows local non-privileged users to access freed GPU memory, which can lead to potential memory corruption, data leakage, or system instability. However, no known exploits are reported in the wild, and the impact is limited to local users with access to GPU memory operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to GPU memory operations where possible to reduce risk.