CVE-2026-9040: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Arm Ltd Bifrost GPU Kernel Driver
CVE-2026-9040 is a race condition vulnerability in Arm Ltd's Bifrost, Valhall, and 5th Gen GPU Kernel Drivers. It allows a local non-privileged user process to perform improper GPU memory operations, potentially causing denial of service or disclosure of sensitive information. The affected versions span multiple release ranges for each GPU architecture. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
This vulnerability involves a race condition (CWE-362) in Arm Ltd's GPU kernel drivers for Bifrost, Valhall, and 5th Gen GPU architectures. A local non-privileged user process can exploit improper synchronization during GPU memory processing operations, leading to denial of service or sensitive information disclosure. The affected versions include Bifrost GPU Kernel Driver from r12p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r19p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. There is no CVSS score or vendor advisory indicating patch availability or mitigation.
Potential Impact
A local non-privileged user can exploit this race condition to cause denial of service or disclose sensitive information via improper GPU memory processing. This could affect system stability and confidentiality on devices using the affected GPU kernel drivers.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local untrusted access to affected systems and monitor for updates from Arm Ltd.
CVE-2026-9040: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Arm Ltd Bifrost GPU Kernel Driver
Description
CVE-2026-9040 is a race condition vulnerability in Arm Ltd's Bifrost, Valhall, and 5th Gen GPU Kernel Drivers. It allows a local non-privileged user process to perform improper GPU memory operations, potentially causing denial of service or disclosure of sensitive information. The affected versions span multiple release ranges for each GPU architecture. No official patch or remediation guidance is currently available.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a race condition (CWE-362) in Arm Ltd's GPU kernel drivers for Bifrost, Valhall, and 5th Gen GPU architectures. A local non-privileged user process can exploit improper synchronization during GPU memory processing operations, leading to denial of service or sensitive information disclosure. The affected versions include Bifrost GPU Kernel Driver from r12p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r19p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. There is no CVSS score or vendor advisory indicating patch availability or mitigation.
Potential Impact
A local non-privileged user can exploit this race condition to cause denial of service or disclose sensitive information via improper GPU memory processing. This could affect system stability and confidentiality on devices using the affected GPU kernel drivers.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local untrusted access to affected systems and monitor for updates from Arm Ltd.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Arm
- Date Reserved
- 2026-05-19T17:09:31.535Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa01dbcacd9273b49c83736
Added to database: 09/08/2026, 14:37:48 UTC
Last enriched: 09/08/2026, 14:53:09 UTC
Last updated: 09/08/2026, 22:33:00 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.