CVE-2026-12387: CWE-416 Use After Free in Arm Ltd Bifrost GPU Kernel Driver

This vulnerability (CVE-2026-12387) involves a Use After Free condition in Arm Ltd's Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, and Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can exploit this flaw by performing valid GPU memory processing operations that access memory regions that have already been freed. The affected versions include Bifrost GPU Kernel Driver from r41p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. No patch or remediation information is provided in the input data.

The vulnerability allows local non-privileged user processes to access freed GPU memory, which could lead to information disclosure or integrity issues related to GPU memory contents. The CVSS vector indicates low attack complexity and no required privileges or user interaction, but the impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict local access to trusted users and monitor for updates from Arm Ltd regarding remediation.