CVE-2026-0860: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Arm Ltd Valhall GPU Kernel Driver

This vulnerability (CVE-2026-0860) involves an exposure of sensitive information (CWE-200) due to improper GPU memory processing operations in the Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can exploit this flaw to gain unauthorized access to sensitive kernel information. The affected versions include Valhall GPU Kernel Driver from r29p0 through r49p5, r50p0 through r54p3, and r55p0, as well as Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. The CVSS v3.1 base score is 7.5, indicating high severity, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability.

An attacker with local access but no privileges can exploit this vulnerability to access sensitive kernel information through improper GPU memory handling. This exposure could lead to information disclosure that may aid further attacks or compromise system confidentiality. There is no reported impact on integrity or availability.

No patch or remediation information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users and monitor for suspicious activity related to GPU memory operations.