CVE-2026-0860 in Valhall GPU Kernel Driver
Summary
by MITRE • 09/08/2026
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel information.
This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in the Arm Ltd Valhall GPU Kernel Driver and the Arm 5th Gen GPU Architecture Kernel Driver represents a critical failure in memory isolation boundaries within the graphics processing unit subsystem of affected Android devices. This flaw allows a local non-privileged user process to exploit improper handling of GPU memory operations, resulting in the exposure of sensitive kernel information that should remain strictly confined to privileged execution contexts. The core technical issue stems from insufficient validation or access control checks during the interaction between user-space applications and the kernel-level driver components responsible for managing graphics resources. When a malicious application initiates specific GPU memory processing requests, it can trigger logic errors within the driver that fail to properly segregate virtual address spaces or enforce permission levels correctly. This breakdown in isolation permits the unauthorized actor to read physical memory addresses mapped by the kernel, effectively bypassing standard security mechanisms designed to protect system integrity and confidentiality.
From a technical perspective, this vulnerability aligns with CWE-200, which classifies exposure of sensitive information to an unauthorized actor as a significant weakness in software design and implementation. The exploitation vector relies on local privilege escalation techniques where the attacker leverages their existing low-level access rights within the operating system sandbox to probe deeper into kernel memory structures. By manipulating GPU command buffers or memory allocation requests, the adversary can cause the driver to leak pointers, stack contents, or other sensitive data back to user space. This capability is particularly dangerous because it provides a foothold for further exploitation chains that may lead to arbitrary code execution with root privileges. The vulnerability affects multiple revisions of both the Valhall GPU Kernel Driver and the Arm 5th Gen GPU Architecture Kernel Driver, specifically covering versions from r29p0 through r49p5, as well as r50p0 through r54p3 and r55p0 for the respective drivers. This broad range indicates a systemic issue in how these driver families handle memory mapping and access control across different hardware generations and software updates.
The operational impact of this vulnerability is severe, as it undermines the fundamental trust model of mobile operating systems like Android that rely on strict sandboxing to prevent malicious apps from compromising system stability or stealing user data. An attacker who successfully exploits this flaw can gain insight into kernel memory layouts, which facilitates advanced attacks such as return-oriented programming (ROP) chains or direct manipulation of critical kernel structures. This level of access allows the compromise of confidentiality for sensitive information stored in kernel space, including cryptographic keys, session tokens, and personal user data processed by privileged services. Furthermore, the ability to read arbitrary kernel memory can aid in defeating security mitigations such as Kernel Address Space Layout Randomization (KASLR), making subsequent exploitation steps more reliable and predictable. The presence of this flaw across multiple driver versions suggests that legacy code paths or backward compatibility features may have introduced regression bugs where proper access controls were inadvertently weakened or omitted during development cycles.
To mitigate the risks associated with this vulnerability, device manufacturers must ensure that affected devices receive timely security patches that address the improper GPU memory processing logic within the specified driver versions. Users should prioritize installing the latest available software updates provided by their device vendors to apply these critical fixes. In environments where immediate patching is not feasible, defense-in-depth strategies such as enforcing strict application sandboxing policies and monitoring for anomalous GPU resource usage patterns can help detect potential exploitation attempts. Additionally, developers integrating Arm GPU drivers into custom builds should review memory management routines to ensure that all user-supplied inputs are rigorously validated before being passed to the kernel driver. Adherence to secure coding standards and regular security audits of graphics subsystems will reduce the likelihood of similar exposure vulnerabilities arising in future releases. The resolution requires a comprehensive update to the affected driver versions, ensuring that access control checks are robustly implemented for all GPU memory operations initiated by non-privileged processes.