CVE-2026-0860

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel information.

This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Arm Ltd	Valhall GPU Kernel Driver	>= r29p0, <= r49p5; >= r50p0, <= r54p3; r55p0
Arm Ltd	Arm 5th Gen GPU Architecture Kernel Driver	>= r41p0, <= r49p5; >= r50p0, <= r54p3; r55p0

References

https://support.arm.com/documentation/111552/1-0/?lang=en

Timeline

Published: Sep 8, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-08618.4Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.3 CVE-2026-08626.1The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all v CVE-2026-08639.9Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unr CVE-2026-08645.5When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the CVE-2026-08655.9User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-08676.4The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category,CVE-2026-08686.4The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calen CVE-2026-08698.8Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL)CVE-2026-08707.8MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applicatio CVE-2026-08714.9A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unma CVE-2026-08722.5Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Val CVE-2026-08734.8On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration co