CVE-2026-9040: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Arm Ltd Bifrost GPU Kernel Driver

This vulnerability involves improper synchronization (CWE-362) in Arm Ltd's GPU kernel drivers (Bifrost, Valhall, and 5th Gen GPU Architecture). A local non-privileged user process can exploit a race condition to perform improper GPU memory processing operations, leading to denial of service or sensitive information disclosure. Affected versions include Bifrost GPU Kernel Driver from r12p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2; Valhall GPU Kernel Driver from r19p0 through r49p5, r50p0 through r54p3, and r55p0; and Arm 5th Gen GPU Architecture Kernel Driver from r41p0 through r49p5, r50p0 through r54p3, and r55p0. There is no information on available patches or vendor advisories.

Exploitation of this race condition vulnerability can allow a local non-privileged user to cause a denial of service or disclose sensitive information via improper GPU memory operations. The impact is limited to local users and does not require user interaction. The confidentiality impact is high, integrity impact is none, and availability impact is high as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only to mitigate risk.