CVE-2026-7476: Arm GPU Kernel Driver Use After Free Vulnerability

CVE-2026-7476 Overview

CVE-2026-7476 is a use-after-free vulnerability [CWE-416] affecting multiple Arm Mali GPU kernel drivers, including the Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers. A local non-privileged user process can trigger improper GPU memory processing operations to access already freed kernel memory. Successful exploitation can lead to local privilege escalation on affected Android and Linux systems that use Arm Mali GPUs.

Critical Impact
A local, unprivileged process can corrupt freed GPU kernel memory to compromise confidentiality, integrity, and availability of the host kernel.

Affected Products

Arm Bifrost GPU Kernel Driver: r49p3 through r49p5, r51p0, and r54p1 through r54p2
Arm Valhall GPU Kernel Driver: r49p3 through r49p5, r51p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Kernel Driver: r49p3 through r49p5, r51p0 through r54p3, and r55p0

Discovery Timeline

2026-09-08 - CVE-2026-7476 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-7476

Vulnerability Analysis

The flaw resides in the Arm Mali GPU kernel driver's handling of GPU memory objects. Under specific sequences of ioctl calls issued from user space, the driver releases a memory region while a reference to that region remains reachable. Subsequent GPU memory processing operations dereference the stale reference, resulting in a use-after-free condition in kernel context.

Because GPU drivers execute with kernel privileges and manage DMA-capable memory shared between the CPU and GPU, use-after-free conditions in this subsystem are historically leveraged for local privilege escalation on Android devices. An attacker who reclaims the freed slab object with attacker-controlled data can influence kernel control flow or corrupt adjacent kernel structures.

Root Cause

The root cause is improper lifetime management of GPU memory objects within the kernel driver. The driver frees a backing allocation without invalidating or synchronizing all outstanding references held by concurrent GPU operations. This mismatch between object lifetime and reference validity produces the dangling pointer that defines a classical use-after-free [CWE-416].

Attack Vector

Exploitation requires local access with the ability to execute code as a non-privileged user, including untrusted applications on Android devices that expose the Mali GPU device node to the app sandbox. No user interaction is required. The attacker interacts directly with the GPU driver through standard device file ioctl interfaces, triggers the vulnerable code path, and then races to reclaim the freed memory before it is reused by legitimate kernel code.

No public proof-of-concept exploit is currently listed for CVE-2026-7476, and it is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the ARM Documentation Release for authoritative technical details.

Detection Methods for CVE-2026-7476

Indicators of Compromise

Unexpected kernel oops or panic messages referencing Mali GPU driver symbols such as kbase_, mali_, or the /dev/mali0 device node
Untrusted applications opening /dev/mali0 and issuing high volumes of memory allocation, mapping, and free ioctls in rapid succession
Presence of driver versions in the affected r49p3–r55p0 range on production or managed devices

Detection Strategies

Inventory GPU driver versions across Android and Linux fleets and flag hosts running affected Bifrost, Valhall, or 5th Gen kernel driver releases
Monitor kernel logs (dmesg, logcat -b kernel) for slab corruption, KASAN reports, or use-after-free warnings tied to Mali driver code paths
Correlate GPU driver crashes with process ancestry to identify untrusted apps or sandboxed processes as the originating context

Monitoring Recommendations

Forward kernel and audit logs from Linux and Android endpoints to a centralized analytics platform to hunt for driver-level anomalies at scale
Alert on privilege transitions where a process that recently accessed /dev/mali0 spawns a child with elevated capabilities or SELinux domain
Track patch compliance for GPU driver updates as a discrete metric within vulnerability management dashboards

How to Mitigate CVE-2026-7476

Immediate Actions Required

Identify all devices running affected Bifrost, Valhall, or Arm 5th Gen GPU kernel driver versions and prioritize them for patching
Apply the fixed Mali GPU kernel driver release published by Arm and delivered through device or SoC vendor firmware updates
Restrict installation of untrusted applications on managed Android devices until vendor patches are deployed

Patch Information

Arm has published fixed driver releases through its documentation portal. Consult the ARM Documentation Release for the specific patched versions and integrate the updated driver via the device OEM or SoC vendor's monthly security update channel. On Android, the fix will typically ship as part of a vendor security patch level update.

Workarounds

Limit access to the Mali GPU device node using SELinux policy so that only required system components can issue ioctls to the driver
Enforce mobile device management policies that prohibit sideloading and restrict installation to vetted application sources
Where feasible, disable GPU compute workloads originating from untrusted user contexts until the patched driver is installed

bash

# Example: verify installed Mali GPU driver version on Linux/Android
cat /sys/module/mali_kbase/version 2>/dev/null || \
  dmesg | grep -i -E 'mali|kbase' | head -n 20