CVE-2026-11891 is a Use After Free vulnerability (CWE-416) in the Arm Ltd Valhall GPU Userspace Driver, which is part of the Arm 5th Gen GPU Architecture Userspace Driver. The flaw allows a non-privileged user process that performs legitimate GPU processing operations, including those initiated via WebGL or WebGPU APIs, to access memory that has already been freed. This could potentially lead to unauthorized memory access or data corruption. The affected versions include Valhall GPU Userspace Driver and Arm 5th Gen GPU Architecture Userspace Driver releases from r46p0 through r49p5, r50p0 through r54p3, and r55p0. There is no CVSS score or vendor advisory detailing remediation or patch availability at this time.

The vulnerability enables non-privileged user processes to access freed memory during GPU processing operations. This could result in unauthorized access to sensitive data or memory corruption within the GPU driver context. However, no known exploits are currently reported in the wild, and the exact impact depends on how the freed memory is leveraged by an attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Arm Ltd communications for updates. No specific mitigation steps are provided at this time.