CVE-2026-11891: CWE-416 Use After Free in Arm Ltd Valhall GPU Userspace Driver

The vulnerability identified as CVE-2026-11891 involves a Use After Free condition in the Arm Ltd Valhall GPU Userspace Driver, specifically within the Arm 5th Gen GPU Architecture Userspace Driver. It affects versions from r46p0 through r49p5, from r50p0 through r54p3, and r55p0. This flaw permits non-privileged user processes executing legitimate GPU processing tasks, including those initiated via WebGL or WebGPU, to access memory regions that have been freed, potentially leading to information disclosure or other unintended behavior.

The impact of this vulnerability is limited to the confidentiality and integrity of memory accessed by GPU userspace processes. It allows non-privileged users to access freed memory, which may lead to information disclosure or corruption of data within the GPU driver context. There is no indication of privilege escalation or availability impact. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting untrusted user access to GPU processing interfaces such as WebGL or WebGPU where feasible.