CVE-2026-0001

MediumCVSS 4.4/10Last modified Sep 8, 2026

Description

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.

This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 8, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-00056.2In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction witCVE-2026-00069.8In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code executCVE-2026-00078.6In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. CVE-2026-00088.4In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalatiCVE-2026-00097.8In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege witCVE-2026-00108.4In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escCVE-2026-00118.4In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the codeCVE-2026-00126.2In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This coulCVE-2026-00138.4In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This couldCVE-2026-00146.2In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This coulCVE-2026-00156.2In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lCVE-2026-00163.3In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a pe
CVE-2026-0001: Medium severity, CVSS 4.4 | Vulnix