CVE-2026-5729: Arm GPU Kernel Driver Use After Free Flaw

CVE-2026-5729 Overview

CVE-2026-5729 is a use-after-free vulnerability in the Arm Valhall GPU Kernel Driver and the Arm 5th Gen GPU Architecture Kernel Driver. A local, non-privileged user process can issue valid GPU processing operations that access already freed kernel memory. Successful exploitation on affected systems can lead to memory corruption in kernel context, enabling privilege escalation on devices that ship these Arm Mali GPU drivers, including many Android handsets and embedded Linux platforms.

The issue is classified under CWE-416: Use After Free and requires only local access with low privileges.

Critical Impact
A local, low-privileged process can trigger kernel-mode use-after-free through GPU operations, resulting in confidentiality, integrity, and availability impact on affected Arm GPU driver versions.

Affected Products

Arm Valhall GPU Kernel Driver: r50p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Kernel Driver: r50p0 through r54p3, and r55p0
Downstream Android and Linux distributions that integrate these Arm Mali kernel driver releases

Discovery Timeline

2026-09-08 - CVE-2026-5729 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-5729

Vulnerability Analysis

The vulnerability resides in the Arm Mali GPU kernel driver stack shared by the Valhall and 5th Gen GPU architectures. A local non-privileged user process can submit valid GPU processing operations through the driver's user-facing interfaces. Under specific conditions, the driver frees a memory object while a reference to it remains reachable through subsequent GPU operations, producing a classic use-after-free condition [CWE-416].

Because the affected code executes in kernel context, dereferencing the stale pointer allows the user process to interact with kernel memory that has been reallocated for another purpose. Attackers commonly weaponize this pattern by racing to reclaim the freed slab object with attacker-controlled data, then triggering the dangling reference to corrupt kernel structures or hijack control flow.

Root Cause

The root cause is improper lifetime management of GPU-related kernel objects between allocation, freeing, and continued reference by in-flight GPU workloads. The driver releases the backing memory before all valid GPU operation paths have relinquished access to it. See the Arm Product Security Notice for vendor-published details.

Attack Vector

Exploitation requires local access with an unprivileged account. No user interaction is required, and the attack executes entirely from userspace by issuing legitimate GPU ioctl or command-submission sequences to the Mali driver. On Android devices, this typically means an installed application interacting with /dev/mali0. Successful exploitation yields kernel memory corruption that can be escalated to arbitrary kernel read/write and full device compromise.

No public proof-of-concept exploit is listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog at time of publication.

Detection Methods for CVE-2026-5729

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN use-after-free reports referencing Mali GPU driver symbols
Non-system applications repeatedly opening /dev/mali0 and issuing high volumes of GPU memory allocation and free ioctls
Kernel logs showing crashes or stack traces originating in Valhall or 5th Gen GPU driver code paths

Detection Strategies

Inventory Android and Linux devices to identify Mali GPU driver versions in the r50p0–r54p3 and r55p0 range
Monitor kernel ring buffer (dmesg) and vendor crash telemetry for repeated GPU driver faults from the same user or process
Correlate application installations with subsequent kernel instability events on managed mobile fleets through MDM telemetry

Monitoring Recommendations

Enable and retain kernel crash dumps on affected fleets to support post-incident analysis of suspected GPU driver exploitation
Forward mobile and Linux endpoint kernel logs to a centralized data lake for correlation with process execution telemetry
Track privilege escalation indicators such as unexpected uid=0 transitions from previously unprivileged application processes

How to Mitigate CVE-2026-5729

Immediate Actions Required

Identify all devices running Valhall or 5th Gen GPU Architecture kernel drivers within the affected version ranges
Apply the fixed Mali GPU kernel driver release published by Arm and integrated by the device or SoC vendor
Prioritize patching on multi-tenant Linux systems and Android devices used by high-risk users

Patch Information

Arm has published guidance for this issue in the Arm Product Security documentation portal. Fixed driver versions must be obtained from Arm and typically reach end-user devices through SoC vendors, OEM firmware updates, and Android security bulletins. Coordinate with device vendors to confirm the specific patched driver revision shipped for each platform.

Workarounds

Restrict installation of untrusted applications on affected Android devices until vendor patches are available
Where policy allows, remove or restrict access to the Mali GPU device node for untrusted users on multi-user Linux systems
Apply application allowlisting and mobile threat defense policies to reduce the risk of local exploit delivery

bash

# Example: check the Mali kernel driver version string on an affected Linux/Android system
cat /sys/module/mali_kbase/version 2>/dev/null || \
  dmesg | grep -iE 'mali|kbase' | head -n 20