CVE-2026-12387 Overview
CVE-2026-12387 is a use-after-free vulnerability [CWE-416] affecting Arm Ltd Mali GPU kernel drivers across the Bifrost, Valhall, and Arm 5th Gen GPU architectures. A local non-privileged user process can perform valid GPU memory processing operations to access memory that has already been freed. The flaw resides in the kernel driver layer, which means successful exploitation impacts kernel-level memory integrity. Arm published details in its official documentation portal covering the affected driver ranges and remediation guidance.
Critical Impact
A local, non-privileged user can trigger the use-after-free through legitimate GPU memory operations, potentially leading to information disclosure or memory corruption in the kernel driver.
Affected Products
- Arm Bifrost GPU Kernel Driver: r41p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2
- Arm Valhall GPU Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0
- Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0
Discovery Timeline
- 2026-09-08 - CVE-2026-12387 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-12387
Vulnerability Analysis
The vulnerability is a use-after-free condition in the Arm Mali GPU kernel driver. The driver mediates memory-management requests between userland GPU clients and kernel-managed GPU memory objects. Under specific conditions, a local process can perform GPU memory processing operations that reference memory regions after the driver has released them.
Because the flawed code path runs in kernel context, dangling references can be reused to read stale kernel data or corrupt adjacent allocations. The issue affects three driver families that share memory-management infrastructure, which explains why Bifrost, Valhall, and Arm 5th Gen kernel drivers are all in scope.
Use-after-free defects in GPU drivers are attractive to attackers targeting Android and Linux devices because GPU device nodes are typically accessible to unprivileged applications. Prior Mali driver flaws have been chained into privilege escalation on mobile platforms.
Root Cause
The root cause is improper lifetime tracking of GPU memory objects. The driver frees a memory structure while another code path still holds and dereferences a pointer to it during GPU memory processing operations. Arm's advisory covers the affected code paths across the impacted driver revisions. Refer to the ARM Documentation for the specific components involved.
Attack Vector
Exploitation requires local access. An attacker running an unprivileged process on the target device opens the Mali GPU device node and issues a sequence of valid memory processing ioctls. The sequence triggers the free path while a stale reference remains reachable, then reuses the freed allocation. No user interaction or elevated privileges are required to reach the vulnerable code.
Detection Methods for CVE-2026-12387
Indicators of Compromise
- Unexpected kernel oops or panic entries in dmesg referencing the Mali kernel driver (mali_kbase) or GPU memory management functions.
- Repeated KASAN: use-after-free reports in kernel logs on devices with kernel address sanitizer enabled.
- Unprivileged processes opening /dev/mali0 and issuing high-frequency memory allocation and free ioctls in short sequences.
Detection Strategies
- Audit userland processes that hold file descriptors to Mali GPU device nodes and correlate with process privilege and origin.
- Instrument kernel telemetry to flag repeated GPU memory allocation and release patterns from a single non-privileged process.
- Monitor for crash signatures in the Mali driver stack that indicate memory corruption rather than routine faults.
Monitoring Recommendations
- Collect kernel logs from Android and Linux endpoints running Arm Mali GPUs and forward them to a centralized log platform.
- Track installed Mali driver revisions across the fleet and alert on any version within the vulnerable ranges.
- Establish a baseline of GPU driver crash rates and alert on statistically significant deviations.
How to Mitigate CVE-2026-12387
Immediate Actions Required
- Inventory devices running Arm Mali GPUs and identify kernel driver revisions against the affected ranges listed above.
- Apply the fixed Mali GPU kernel driver revisions published by Arm and integrated by the device or SoC vendor.
- Restrict installation of untrusted applications on affected devices until patches are deployed.
Patch Information
Arm has published remediation guidance in its security advisory portal. Device manufacturers and Linux distributions integrating the Mali kernel driver must ship updated driver builds outside the vulnerable version ranges. Refer to the ARM Documentation for the authoritative fixed versions and integration guidance.
Workarounds
- Limit access to the Mali GPU device node where operationally feasible by tightening permissions on /dev/mali0.
- Reduce the attack surface by disallowing sideloaded or unvetted applications on production devices.
- Prioritize patching for multi-tenant or shared-use devices where local unprivileged access is more likely.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
