CVE-2026-0001: Arm GPU Kernel Driver Use After Free Flaw

CVE-2026-0001 Overview

CVE-2026-0001 is a use-after-free vulnerability [CWE-416] in the Arm Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers. A local non-privileged user process can perform valid GPU memory processing operations that access already freed memory. The flaw affects the graphics driver stack shipped in a wide range of Arm Mali-based devices, including Android smartphones and embedded systems.

Critical Impact
Local, non-privileged code can trigger memory corruption in the GPU kernel driver, exposing kernel memory to unauthorized read and write access and enabling further exploitation on affected devices.

Affected Products

Arm Bifrost GPU Kernel Driver: r41p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2
Arm Valhall GPU Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0

Discovery Timeline

2026-09-08 - CVE-2026-0001 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-0001

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] inside the Arm Mali GPU kernel driver. A local, low-privileged process can issue legitimate GPU memory processing operations that cause the driver to reference memory after it has been freed. Because GPU drivers run in kernel context, the dangling reference occurs in a privileged execution boundary.

Exploitation requires local access and low privileges, with no user interaction. The impact is scoped to confidentiality and integrity, allowing an attacker to read or modify kernel memory contents reachable through the driver. Arm attributes the issue to the driver's handling of GPU memory allocation lifetimes rather than to a hardware defect.

Use-after-free flaws in GPU drivers have historically served as building blocks for Android sandbox escapes and root-level compromise. Attackers frequently chain them with heap grooming primitives to gain arbitrary kernel read and write access.

Root Cause

The root cause is improper lifetime management of GPU memory objects in the Mali driver. Specific memory processing operations release backing memory while other driver paths retain a usable reference. When those paths dereference the stale pointer, the driver operates on memory that may have been reallocated for unrelated kernel data.

Attack Vector

A local attacker executes an unprivileged process on the target device, typically through an application or shell context. The process issues a sequence of valid ioctl-level GPU memory operations against the Mali kernel driver. The operations reach the vulnerable freed-memory path and produce corruption that the attacker can shape to overlap sensitive kernel structures.

See the ARM Support Documentation for vendor technical details.

Detection Methods for CVE-2026-0001

Indicators of Compromise

Unexpected kernel oops or panic messages referencing the Mali GPU driver (mali_kbase, kbase_) in dmesg or logcat.
Unprivileged processes issuing high volumes of GPU ioctl calls against /dev/mali0 outside of normal graphics workloads.
Crashes in unrelated kernel subsystems shortly after Mali driver activity, indicating possible heap corruption.

Detection Strategies

Monitor process telemetry for non-graphics applications opening /dev/mali0 and invoking GPU memory management ioctls.
Correlate kernel crash traces with the process that most recently interacted with the Mali driver.
Track installed Mali driver versions across the fleet and flag any device running an affected r4x, r5x, or r55p0 release.

Monitoring Recommendations

Baseline expected GPU driver interactions per application and alert on deviations, especially from background or newly installed apps.
Ingest device kernel logs into a centralized data lake to enable retrospective hunting across driver-related crashes.
Review mobile device management (MDM) inventory data to prioritize devices with vulnerable Mali driver versions for patching.

How to Mitigate CVE-2026-0001

Immediate Actions Required

Identify devices running affected Bifrost, Valhall, or 5th Gen GPU kernel driver versions and prioritize them for updates.
Apply vendor security patches through OEM firmware updates as soon as they become available for affected handsets and embedded platforms.
Restrict installation of untrusted applications on affected devices, as local code execution is required to exploit the flaw.

Patch Information

Arm has published driver updates addressing the use-after-free condition. Refer to the ARM Support Documentation for the fixed driver revisions and integration guidance. Downstream OEMs must incorporate the updated driver into device firmware; end users should apply the corresponding Android or vendor security update when released.

Workarounds

No official workaround eliminates the vulnerability; only the vendor-supplied driver update fully resolves it.
Reduce exposure by limiting sideloaded applications and enforcing application allow-listing on managed mobile devices.
Where feasible, apply MDM policies that block installation from unknown sources until patched firmware is deployed.

bash

# Check the installed Mali GPU kernel driver version on an affected device
adb shell cat /sys/module/mali_kbase/version
adb shell dmesg | grep -i mali