CVE-2026-7477 is a Use After Free vulnerability (CWE-416) in Arm Ltd's Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, and Arm 5th Gen GPU Architecture Kernel Driver. The vulnerability allows a local non-privileged user process to perform legitimate GPU memory processing operations that access memory regions that have already been freed, potentially leading to undefined behavior or security issues. The affected versions include Bifrost GPU Kernel Driver from r44p0 through r49p4, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r44p0 through r49p5 and r50p0 through r54p3; and Arm 5th Gen GPU Architecture Kernel Driver from r44p0 through r49p5, r50p0 through r54p3, and r55p0.

The vulnerability allows local non-privileged users to access freed GPU memory, which may lead to memory corruption or unauthorized access to sensitive data. However, no specific exploit or active attacks are known at this time. The impact is limited to local users with access to GPU memory processing capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.