CVE-2026-9040: Arm GPU Kernel Driver Race Condition Flaw

CVE-2026-9040 Overview

CVE-2026-9040 is a race condition vulnerability affecting multiple Arm Mali GPU kernel drivers, including the Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers. A local, non-privileged user process can trigger improper GPU memory processing operations to cause a denial of service or disclose sensitive information. The vulnerability is tracked under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization. Arm has published guidance in its ARM Documentation Update advisory.

Critical Impact
A local unprivileged process can race GPU memory operations to leak kernel memory contents or crash the GPU driver, impacting availability on Android and Linux devices using Arm Mali GPUs.

Affected Products

Arm Bifrost GPU Kernel Driver: r12p0 through r49p5, r50p0 through r51p0, and r54p1 through r54p2
Arm Valhall GPU Kernel Driver: r19p0 through r49p5, r50p0 through r54p3, and r55p0
Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r49p5, r50p0 through r54p3, and r55p0

Discovery Timeline

2026-09-08 - CVE-2026-9040 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-9040

Vulnerability Analysis

The flaw resides in the GPU kernel driver code that manages GPU memory processing on behalf of userspace clients. Concurrent execution paths access shared GPU memory state without proper synchronization. A local attacker with normal user privileges can invoke the driver from multiple threads to force a time-of-check to time-of-use (TOCTOU) window during memory management operations.

Exploiting this window allows the attacker to influence how the driver treats memory objects mid-operation. The result is either a driver crash that denies service to all GPU consumers or leakage of kernel memory contents to the attacking process. Because Mali GPUs ship in the majority of Android handsets and many embedded Linux platforms, the practical exposure spans mobile, automotive, and edge devices.

Root Cause

The root cause is improper synchronization of concurrent GPU memory operations in the Mali kernel driver. The affected code paths validate memory state and then act on that state without holding a lock across both operations. A second thread can modify the shared resource between validation and use, invalidating the driver's assumptions.

Attack Vector

Exploitation requires local access with the ability to open the Mali GPU device node, typically /dev/mali0, which is accessible to unprivileged applications on Android and desktop Linux. No user interaction is required. The attacker issues concurrent ioctl calls that manipulate GPU memory allocations while a second thread races the same objects to trigger the unsynchronized path. Successful exploitation yields either kernel information disclosure or a kernel-level denial of service affecting the graphics subsystem.

No public proof-of-concept exploit is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-9040

Indicators of Compromise

Repeated GPU driver crashes or kernel oops messages referencing the Mali kbase driver in dmesg or the Android kernel log
Unprivileged processes opening /dev/mali0 and issuing high volumes of concurrent memory-related ioctl calls
Unexpected reboots, GPU resets, or display subsystem failures on devices running affected driver versions

Detection Strategies

Inventory Android and Linux endpoints to identify Mali GPU kernel driver versions and match them against the affected ranges listed in the Arm advisory
Monitor kernel logs for panic signatures involving kbase_, mali_, or GPU memory management functions
Alert on processes that spawn multiple threads targeting the Mali device node in rapid succession from non-graphics applications

Monitoring Recommendations

Centralize kernel and system logs from mobile and Linux fleets into a SIEM for correlation of GPU driver faults
Track application behavior for unexpected access to /dev/mali0 from processes outside the normal graphics stack
Review vendor and carrier security bulletins for downstream patches that incorporate the Arm fix

How to Mitigate CVE-2026-9040

Immediate Actions Required

Identify all devices running Bifrost driver versions in the ranges r12p0–r49p5, r50p0–r51p0, or r54p1–r54p2
Identify all devices running Valhall or 5th Gen driver versions in the ranges r19p0/r41p0–r49p5, r50p0–r54p3, or r55p0
Apply vendor updates as soon as SoC vendors and OEMs release patched kernels for the affected platforms
Restrict installation of untrusted applications on affected mobile devices until patches are deployed

Patch Information

Arm has published fixed driver revisions and remediation guidance in the ARM Documentation Update. Because the Mali kernel driver is integrated by SoC vendors and shipped through OEM firmware, end users typically receive the fix via Android security bulletins or Linux distribution kernel updates. Confirm the fixed driver version with the device vendor before considering a device remediated.

Workarounds

No official workaround eliminates the race condition; upgrading to a fixed driver revision is the only complete remediation
Reduce risk by enforcing application allowlisting and blocking sideloaded applications on managed mobile devices
Where feasible on Linux systems, restrict access to /dev/mali0 using device permissions or Mandatory Access Control policies

bash

# Example: verify Mali kernel driver version on Linux/Android
cat /sys/module/mali_kbase/version 2>/dev/null || \
  dmesg | grep -i "mali" | grep -Ei "version|r[0-9]+p[0-9]+"

# Example: restrict access to the Mali device node on Linux
chown root:video /dev/mali0
chmod 0660 /dev/mali0