CVE-2026-12285: Arm GPU Kernel Driver Use After Free Flaw

CVE-2026-12285 Overview

CVE-2026-12285 is a use-after-free vulnerability [CWE-416] affecting multiple Arm Mali GPU kernel drivers. The flaw allows a local, non-privileged user process to perform valid GPU memory processing operations that access already freed memory. Affected drivers include the Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers across a broad range of released versions. The issue is local to the device and does not require user interaction or elevated privileges to trigger.

Critical Impact
A local unprivileged process can trigger memory access to freed GPU allocations, enabling information disclosure and potential exploitation for further compromise on Android and Linux systems that ship Arm Mali GPU drivers.

Affected Products

Arm Bifrost GPU Kernel Driver: r41p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2
Arm Valhall GPU Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0

Discovery Timeline

2026-09-08 - CVE-2026-12285 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-12285

Vulnerability Analysis

The vulnerability resides in the memory management logic of the Arm Mali GPU kernel drivers. During specific GPU memory processing sequences issued from userspace, the driver retains a reference to a memory object after that object has been freed. Subsequent operations act on the stale reference, producing a use-after-free condition inside the kernel driver context. Because the drivers execute in kernel space and mediate shared GPU resources, dereferencing freed allocations can leak kernel memory contents to the calling process. This class of GPU driver flaw has historically been chained with additional primitives to escalate privileges on Android devices.

Root Cause

The root cause is improper lifetime management of GPU memory objects [CWE-416]. The driver frees a memory allocation while another code path still holds and dereferences a pointer to it. The vulnerability affects releases spanning multiple driver families, indicating the defect exists in shared memory-handling code paths reused across Bifrost, Valhall, and 5th Gen GPU Architecture branches.

Attack Vector

Exploitation requires local access. An attacker running an unprivileged process on a device with a vulnerable Arm Mali GPU driver issues sequences of valid GPU memory operations through the standard driver interface. No special permissions, authentication, or user interaction are required. The attacker interacts with the GPU driver through the exposed device node used by graphics and compute workloads. Refer to the ARM Security Advisory 111552 for technical details on the affected code paths.

Detection Methods for CVE-2026-12285

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN reports referencing Mali driver symbols such as kbase_ prefixed functions
Unprivileged processes repeatedly opening /dev/mali0 and issuing high volumes of memory allocation, mapping, and free ioctls
Anomalous GPU driver log entries indicating invalid memory handles or freed object access

Detection Strategies

Monitor Android and Linux endpoint telemetry for unsigned or unknown binaries that interact directly with the Mali GPU device node
Correlate kernel crash dumps with process ancestry to identify local processes triggering GPU driver faults
Track installed driver versions across the fleet and flag hosts running affected r41p0–r55p0 ranges

Monitoring Recommendations

Ingest kernel logs (dmesg, logcat) into a centralized data lake and alert on Mali driver fault signatures
Baseline expected GPU workload processes and alert when non-graphical userspace binaries invoke GPU ioctls
Review mobile device management (MDM) reports for devices missing the latest vendor security patch level

How to Mitigate CVE-2026-12285

Immediate Actions Required

Inventory all Android devices, Chromebooks, and Linux systems running Arm Mali GPUs and identify installed kernel driver versions
Apply the vendor patch supplied through the Arm security advisory or downstream OEM security update as soon as it is available
Restrict installation of untrusted applications on affected mobile and embedded devices until patched

Patch Information

Arm has published fix details in ARM Security Advisory 111552. Device users should install the corresponding OEM security update. Android users should apply the monthly security patch level that incorporates the fixed Mali driver from their device manufacturer.

Workarounds

No official workaround exists; the recommended remediation is patching to a fixed driver revision
Reduce risk by limiting device access to trusted users and preventing sideloading of unverified applications
On managed fleets, enforce application allowlisting to block untrusted local code from reaching the GPU device node

bash

# Check the installed Mali GPU kernel driver version on Linux/Android
cat /sys/module/mali_kbase/version 2>/dev/null || \
  dmesg | grep -i "mali"