CVE-2026-12285: CWE-416 Use After Free in Arm Ltd Bifrost GPU Kernel Driver

This vulnerability (CVE-2026-12285) involves a Use After Free condition in Arm Ltd's Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, and Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can exploit this flaw by performing valid GPU memory operations that access memory regions that have already been freed, potentially leading to unintended information disclosure. The affected versions include Bifrost GPU Kernel Driver from r41p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. The CVSS vector indicates local attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, and no impact on integrity or availability.

The impact is limited to potential unauthorized read access to freed GPU memory by a local non-privileged user process. There is no indication of integrity or availability impact. The vulnerability does not require privileges or user interaction to exploit but is limited to local access. No known exploits are reported in the wild.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users and processes to reduce risk.