This vulnerability involves a Use After Free (CWE-416) condition in Arm Ltd's GPU userspace drivers for Bifrost, Valhall, and 5th Gen GPU architectures. Specifically, non-privileged user processes executing valid GPU operations—such as those using WebGL or WebGPU—can access memory that has been freed, potentially leading to memory corruption. The affected versions include Bifrost GPU Userspace Driver from r42p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p3; Valhall GPU Userspace Driver from r42p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Userspace Driver from r42p0 through r49p5, r50p0 through r54p3, and r55p0. No patch or official remediation guidance has been published at this time.

The vulnerability allows non-privileged user processes to access freed memory during GPU operations, which can lead to memory corruption. This may result in application crashes, data leakage, or other unpredictable behavior. However, there is no evidence of active exploitation in the wild, and the impact is limited to processes that can perform GPU operations through interfaces like WebGL or WebGPU.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting untrusted user access to GPU processing capabilities where feasible. Monitor vendor communications for updates on patches or mitigations.