CVE-2026-11891: Arm GPU Userspace Driver UAF Vulnerability

CVE-2026-11891 Overview

CVE-2026-11891 is a use-after-free vulnerability [CWE-416] in the Arm Ltd Valhall GPU Userspace Driver and Arm 5th Gen GPU Architecture Userspace Driver. A non-privileged local user process can perform valid GPU processing operations, including through WebGL or WebGPU, to access memory that has already been freed. Because WebGL and WebGPU expose GPU operations to browser content, hostile web pages can potentially reach the affected code paths through a rendering context. The flaw allows limited disclosure and corruption of memory contents on affected Android and Linux systems using the impacted Mali GPU driver stacks.

Critical Impact
A local, unprivileged process, including sandboxed browser content invoking WebGL or WebGPU, can access freed GPU memory to leak or corrupt data in the driver's address space.

Affected Products

Arm Valhall GPU Userspace Driver: r46p0 through r49p5, r50p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Userspace Driver: r46p0 through r49p5, r50p0 through r54p3, and r55p0
Devices shipping Mali GPUs with the above userspace driver versions

Discovery Timeline

2026-09-08 - CVE-2026-11891 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-11891

Vulnerability Analysis

The vulnerability resides in the userspace component of Arm's Valhall and 5th Gen GPU Architecture drivers. During normal GPU command submission, the driver manages lifetimes for GPU memory objects and associated bookkeeping structures. Under specific sequences of valid GPU processing operations, the driver releases a memory object while retaining a reference that the process can still dereference. Subsequent operations against the stale reference read from or write to memory that has been returned to the allocator.

Because WebGL and WebGPU translate JavaScript rendering calls into GPU driver calls, browser-rendered content can trigger the affected code paths without any elevated privileges. This expands the practical attack surface from local applications to any web content the user loads. The flaw affects confidentiality and integrity within the driver's memory context.

Root Cause

The root cause is improper lifetime tracking of GPU memory allocations in the userspace driver. A reference to an allocation persists past the free operation, violating the invariant that freed handles must not be reused. This is a classic use-after-free pattern [CWE-416] in a driver component that handles untrusted input from user processes and browser rendering pipelines.

Attack Vector

Exploitation requires local access. An attacker executes a non-privileged process, or serves malicious web content through a browser that exposes WebGL or WebGPU, and issues a specific sequence of valid GPU processing calls. The sequence causes the driver to free a memory object while continuing to operate on the stale pointer. No authentication or user interaction beyond loading the page is required. Public exploit code is not currently listed for this CVE.

See the ARM Support Documentation for vendor technical details.

Detection Methods for CVE-2026-11891

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libmali or the Arm Bifrost/Valhall userspace GPU libraries
Kernel or userspace logs referencing GPU memory allocation faults, invalid handles, or aborted GPU jobs on Mali-based devices
Browser renderer or GPU process crashes correlated with pages that use WebGL or WebGPU

Detection Strategies

Inventory endpoints and mobile devices running affected Valhall or 5th Gen GPU userspace driver versions between r46p0 and r55p0
Correlate GPU driver crash telemetry with process execution and browser navigation events to identify anomalous WebGL or WebGPU activity
Monitor for unsigned or unexpected native code loading userspace GPU libraries alongside rendering workloads

Monitoring Recommendations

Ingest system crash logs, dmesg output, and browser GPU process telemetry into a centralized log store for cross-source correlation
Track vendor advisories from device OEMs for downstream backports of Arm's driver fix
Alert on repeated GPU driver faults from the same user session as a possible exploitation signal

How to Mitigate CVE-2026-11891

Immediate Actions Required

Identify affected devices running Valhall or 5th Gen GPU userspace drivers in versions r46p0 through r55p0
Apply the fixed driver revisions distributed by Arm and integrated by device OEMs as soon as they are available for your platform
Prioritize devices that browse untrusted web content, since WebGL and WebGPU expand the reachable attack surface

Patch Information

Arm has published guidance in the ARM Support Documentation covering fixed driver revisions. Because Mali GPU drivers ship through SoC vendors and device OEMs, patched userspace drivers reach end users through Android security updates and Linux distribution channels rather than direct download from Arm. Track OEM security bulletins for the corresponding fix.

Workarounds

Disable WebGL and WebGPU in browsers on affected devices until patched drivers are deployed
Restrict execution of untrusted local binaries on systems that cannot be patched immediately
Where policy allows, isolate high-risk browsing to devices not using affected Mali GPU drivers

bash

# Example: check installed Mali userspace driver version on Linux
strings /usr/lib/libmali.so | grep -Ei 'r[0-9]+p[0-9]+'

# Example: disable WebGL in Firefox via about:config
# webgl.disabled = true

# Example: disable WebGPU in Chromium-based browsers
# Launch with: --disable-features=WebGPU