CVE-2026-0860 describes an exposure of sensitive information vulnerability (CWE-200) in the Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can exploit improper GPU memory processing operations to gain access to sensitive kernel information. The affected versions span multiple releases of both drivers, specifically Valhall GPU Kernel Driver versions r29p0 through r49p5, r50p0 through r54p3, and r55p0, and Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r49p5, r50p0 through r54p3, and r55p0. There is no CVSS score or vendor advisory indicating a patch or mitigation at this time.

The vulnerability allows local non-privileged users to access sensitive kernel memory information via improper GPU memory operations, potentially leading to information disclosure. This could undermine system confidentiality by exposing kernel data to unauthorized processes. No information is available about active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published. Until a patch is available, restricting local access to trusted users and processes may reduce risk.