CVE-2026-7477: Arm GPU Kernel Driver Use After Free Flaw

CVE-2026-7477 Overview

CVE-2026-7477 is a use-after-free vulnerability [CWE-416] in multiple Arm Mali GPU kernel drivers. The flaw allows a local, non-privileged user process to issue valid GPU memory processing operations that access already-freed memory. Successful exploitation can compromise confidentiality, integrity, and availability of the affected system. The issue affects the Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers across multiple release branches.

Critical Impact
A local attacker with low privileges can escalate to kernel-level access on Android and Linux devices using vulnerable Arm Mali GPU drivers, potentially achieving full device compromise.

Affected Products

Arm Bifrost GPU Kernel Driver: r44p0 through r49p4, r50p0 through r51p0, r54p1 through r54p2
Arm Valhall GPU Kernel Driver: r44p0 through r49p5, r50p0 through r54p3
Arm 5th Gen GPU Architecture Kernel Driver: r44p0 through r49p5, r50p0 through r54p3, r55p0

Discovery Timeline

2026-09-08 - CVE-2026-7477 published to the National Vulnerability Database
2026-09-10 - CVE-2026-7477 last updated in NVD database

Technical Details for CVE-2026-7477

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Arm Mali GPU kernel driver. A local, non-privileged user process can perform legitimate GPU memory processing operations that reference kernel memory objects after those objects have been freed. Because the operations are considered valid by the driver, no privileged context is required to trigger the flaw.

Use-after-free conditions in GPU kernel drivers are a well-established path to Android and Linux privilege escalation. Attackers typically reclaim the freed allocation with attacker-controlled data, then leverage the dangling reference to corrupt kernel structures. The result is arbitrary kernel read, write, or execution.

Arm Mali GPU flaws have historically been chained by commercial spyware vendors to root mobile devices, making driver-level use-after-free issues a high-value primitive.

Root Cause

The root cause is improper lifetime management of GPU memory objects within the kernel driver. The driver permits user-space to invoke GPU memory processing operations whose backing objects have already been released. The dangling reference is dereferenced during subsequent GPU work, producing the use-after-free condition tracked as [CWE-416].

Attack Vector

Exploitation requires local access and low privileges. Any process able to open the Mali GPU device node, such as /dev/mali0, can invoke the affected ioctl paths. No user interaction is required. On Android, this device node is reachable from third-party applications, which broadens the attack surface to any installed app that abuses the GPU interface.

A public technical write-up of the exploitation mechanics is not currently available. Refer to the ARM Documentation for vendor-supplied details.

Detection Methods for CVE-2026-7477

Indicators of Compromise

Unexpected kernel crashes, oops messages, or panics referencing the Mali driver modules (mali_kbase, kbase_*) in dmesg or logcat.
Non-system applications opening /dev/mali0 and issuing high volumes of memory-mapping or job-submission ioctls.
Sudden privilege changes for user-space processes that previously ran without elevated capabilities.

Detection Strategies

Deploy endpoint telemetry that captures process access to GPU device nodes and correlates it with subsequent privilege transitions.
Monitor kernel logs for repeated GPU driver faults that may indicate exploitation attempts or failed heap grooming.
Use mobile threat defense agents to flag applications that request or interact with /dev/mali0 outside of expected graphics workflows.

Monitoring Recommendations

Baseline legitimate GPU-consuming applications on managed devices and alert on deviations.
Ingest kernel and system logs into a centralized analytics platform to correlate driver crashes with process activity.
Track installed driver versions across the fleet and flag any device still running an affected r44p0–r55p0 release.

How to Mitigate CVE-2026-7477

Immediate Actions Required

Inventory all Android and Linux devices using Arm Mali Bifrost, Valhall, or 5th Gen GPU architectures and identify the installed driver revision.
Apply the vendor-supplied driver updates referenced in the Arm advisory as soon as they are available for your device platform.
Restrict installation of untrusted third-party applications on affected mobile devices until patches are deployed.

Patch Information

Arm has published guidance in the ARM Documentation advisory. Fixed driver revisions supersede the affected r44p0 through r55p0 releases. Device manufacturers must integrate the updated driver into their vendor kernels, and end users must apply the resulting OTA or firmware update.

Workarounds

No official workaround eliminates the vulnerability; patching the GPU kernel driver is the only complete remediation.
Reduce exposure by limiting untrusted local code execution on affected devices and enforcing application allowlisting where feasible.
On managed Linux systems, restrict access to the Mali device node through file-system permissions or Mandatory Access Control policies such as SELinux.

bash

# Verify installed Mali driver version on Linux/Android
dmesg | grep -i "mali"
cat /sys/module/mali_kbase/version 2>/dev/null

# Restrict access to the GPU device node (Linux example)
chmod 0660 /dev/mali0
chown root:graphics /dev/mali0