CVE-2026-0860: Arm GPU Kernel Driver Information Disclosure

CVE-2026-0860 Overview

CVE-2026-0860 is an information disclosure vulnerability affecting the Arm Valhall GPU Kernel Driver and the Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can perform improper GPU memory processing operations to access sensitive kernel information. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation leaks kernel memory contents to unprivileged userland, which can undermine kernel address space layout randomization (KASLR) and enable follow-on privilege escalation chains on affected Arm-based devices.

Critical Impact
A local unprivileged process can leak sensitive kernel memory via the Mali GPU driver, weakening kernel isolation on Android and Linux devices using affected Arm GPU drivers.

Affected Products

Arm Valhall GPU Kernel Driver: r29p0 through r49p5
Arm Valhall GPU Kernel Driver: r50p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0

Discovery Timeline

2026-09-08 - CVE-2026-0860 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-0860

Vulnerability Analysis

The vulnerability resides in the Arm Mali GPU kernel driver components used on devices with Valhall and 5th Gen GPU architectures. The driver mishandles GPU memory processing operations initiated from userland. A local attacker with the ability to execute code as an unprivileged user can trigger these operations to read kernel memory that should remain isolated.

Mali GPU drivers on Android are a common target because they expose an ioctl-based interface to unprivileged apps through /dev/mali0. Any weakness in the memory handling paths of this driver becomes reachable from within the application sandbox. Disclosed kernel data may include pointers, credentials, cryptographic material, and other structures that facilitate subsequent exploitation.

Root Cause

The root cause is improper handling of GPU memory processing operations inside the kernel driver, which allows unintended kernel memory content to be exposed to the requesting user process. This is a classic [CWE-200] information exposure pattern rooted in insufficient boundary or state checks within a privileged kernel component that accepts input from unprivileged callers.

Attack Vector

Exploitation requires local access to a device running an affected driver version. An attacker submits crafted GPU memory operations through the Mali kernel driver interface to coerce the driver into returning data drawn from kernel memory. No user interaction or elevated privileges are required, and the attack can be performed from a standard application context on Android or Linux systems that expose the driver to unprivileged users. Refer to the Arm Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-0860

Indicators of Compromise

Unexpected user-space processes issuing high volumes of ioctl calls against /dev/mali0 or equivalent Mali device nodes.
Applications outside of graphics, gaming, or media workloads interacting directly with the Mali GPU driver interface.
Anomalous crashes or kernel log entries referencing the mali_kbase module during GPU memory operations.

Detection Strategies

Audit installed driver versions on managed Android and Linux endpoints against the affected ranges published by Arm.
Monitor kernel logs (dmesg, logcat -b kernel) for warnings or faults originating in the Mali kernel driver.
Correlate GPU driver activity with process reputation to surface unprivileged applications performing kernel-adjacent operations.

Monitoring Recommendations

Enable telemetry collection for mobile and embedded fleets to track kernel and driver version drift over time.
Alert on newly installed applications that request direct GPU device access without a legitimate graphics workload.
Track post-exploitation behaviors such as unexpected privilege changes or SELinux denials following GPU driver activity.

How to Mitigate CVE-2026-0860

Immediate Actions Required

Inventory devices using Valhall or 5th Gen Arm GPUs and identify those running affected driver revisions between r29p0 and r55p0.
Prioritize patching of Android handsets, tablets, and Arm-based Linux systems that expose the Mali driver to untrusted applications.
Restrict installation of untrusted applications on affected devices until patched driver builds are deployed.

Patch Information

Arm has published a security advisory covering the affected Valhall and 5th Gen GPU kernel driver ranges. Administrators should consult the Arm Documentation portal for fixed driver versions and coordinate with device OEMs and SoC vendors, as GPU driver updates on Android are typically delivered through vendor firmware or monthly Android Security Bulletin releases.

Workarounds

Where patched drivers are not yet available, enforce application allowlisting to limit which processes can interact with the GPU driver.
Apply mobile device management (MDM) policies that block sideloading and require applications from trusted sources only.
Consider disabling or restricting access to GPU compute features on devices that do not require them, in coordination with the platform vendor.

bash

# Check the loaded Mali kernel driver version on an affected Linux/Android device
cat /sys/module/mali_kbase/version 2>/dev/null || \
  dmesg | grep -i "mali" | grep -i "version"