CVE-2026-0860

CVE-2026-0860 is an exposure-of-sensitive-information vulnerability (CWE-200, rated High at CVSS 3.1 7.5) in Arm's Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver, the Mali-family GPU kernel driver components shipped in Android smartphones, tablets, and other embedded or automotive Linux systems. A local, non-privileged user process can trigger improper GPU memory processing operations that expose sensitive kernel information to that process. An attacker gains read access to sensitive kernel memory only (the CVSS vector shows no integrity or availability impact), which can assist further attacks such as privilege-escalation steps. Affected deployments are those running Valhall driver releases r29p0 through r49p5, r50p0 through r54p3, or r55p0, or 5th Gen GPU Architecture driver releases r41p0 through r49p5, r50p0 through r54p3, or r55p0. There is currently no known exploitation: no public proof of concept exists, the issue is not listed in CISA KEV, and EPSS estimates roughly a 0.1% probability of exploitation within the next 30 days.

What to do: Update affected systems to an Arm GPU kernel driver release newer than r55p0, delivered through your SoC or device vendor's (OEM) security updates, since these drivers typically reach end devices via vendor Android/Linux updates. Inventory Android and embedded Linux fleets by checking the GPU kernel driver version against the affected ranges. Because this is a local information-disclosure issue with no known exploitation, prioritize devices that run untrusted third-party apps, and note the published CVSS vector uses AV:N while the description describes local access.