Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-9040

Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information

At a glance

Severity
HIGH 7.7
EPSS
EPSS 0.13 % · percentile 3 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
Arm
NVD status
Awaiting Analysis

Description

A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause a denial of service or disclose sensitive information. This issue affects Bifrost GPU Kernel Driver: from r12p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r19p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.7CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCISA-ADP
CVSS 3.1HIGH 7.7CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

European references

Affected products

ProductVersions
Arm Ltd · Bifrost GPU Kernel Driveraffected r12p0 ≤ r49p5 ; affected r50p0 ≤ r51p0 ; affected r54p1 ≤ r54p2
Arm Ltd · Valhall GPU Kernel Driveraffected r19p0 ≤ r49p5 ; affected r50p0 ≤ r54p3 ; affected r55p0 ; unaffected r56p0
Arm Ltd · Arm 5th Gen GPU Architecture Kernel Driveraffected r41p0 ≤ r49p5 ; affected r50p0 ≤ r54p3 ; affected r55p0 ; unaffected r56p0

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD