CVE-2026-7477 in Bifrost GPU Kernel Driver
Summary
by MITRE • 09/08/2026
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p4, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3, r55p0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The identified vulnerability represents a critical security flaw within the kernel drivers for several generations of Arm graphics processing units, specifically affecting the Bifrost, Valhall, and 5th Generation GPU Architecture drivers. This issue is classified as an Use After Free condition, which occurs when software continues to use a pointer after it has been freed or deallocated from memory. In this specific context, the flaw allows a local non-privileged user process to execute valid GPU memory processing operations that inadvertently target memory regions that have already been released by the system. This discrepancy between the logical state of the driver and the actual physical allocation status creates an opportunity for unauthorized data access and potential code execution.
From a technical perspective, the vulnerability stems from improper management of object lifecycles within the graphics kernel space. When a GPU command buffer or memory region is processed, the driver must ensure that all references to that resource are invalidated before the underlying memory is returned to the pool. The affected versions across the r44p0 through r55p0 release ranges fail to adequately synchronize these operations. Consequently, if an application submits commands referencing a GPU object shortly after it has been freed but before the driver fully cleans up its internal tracking structures, the hardware may proceed with processing those commands against stale memory addresses. This lack of strict validation allows user-space applications to interact with kernel-managed resources in ways that bypass standard access controls designed for non-privileged processes.
The operational impact of this vulnerability is significant due to the potential for privilege escalation and information disclosure. Since the flaw permits a local unprivileged process to read from or write to arbitrary memory locations via GPU operations, an attacker can potentially leak sensitive kernel data structures, such as credentials or encryption keys stored in adjacent memory pages. Furthermore, by carefully crafting the contents of the freed memory region before it is reallocated for another purpose, an attacker may achieve arbitrary code execution with kernel-level privileges. This effectively breaks the isolation boundary between user space and kernel space, allowing a compromised application to take control of the entire operating system instance running on affected Arm-based devices.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-416, which describes Use After Free errors where memory is accessed after it has been freed. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK tactic Tactic 0003 Persistence and Privilege Escalation, specifically through methods that exploit driver vulnerabilities to gain higher-level access. The ability to perform arbitrary read-write operations via the GPU interface also touches upon data exfiltration vectors where sensitive information is smuggled out of protected memory boundaries using side-channel effects or direct memory reads facilitated by the hardware engine itself.
Mitigation strategies primarily involve updating the affected kernel drivers to versions that have implemented proper lifecycle management and validation checks for GPU resources. For systems utilizing Arm Bifrost, Valhall, or 5th Gen GPUs, administrators should ensure they are running driver revisions beyond r49p4 for Bifrost, r51p0 for early Valhall releases, and specifically the patched versions of r54p3 and later for subsequent generations. Where immediate patching is not feasible, restricting GPU access to trusted applications through mandatory access control policies can reduce the attack surface. Additionally, enabling hardware-based memory protection features such as ARM Memory Tagging Extension if available on the specific SoC implementation can help detect or prevent exploitation of this class of vulnerabilities by tagging freed memory regions and raising exceptions when they are accessed incorrectly.