CVE-2026-7476

CVE-2026-7476 is a use-after-free (CWE-416) in Arm's Bifrost, Valhall and Arm 5th Gen GPU Architecture (Mali) kernel drivers that allows a local, non-privileged user process to perform improper GPU memory processing operations and access memory that has already been freed. It is triggered by a local user process performing GPU memory operations against an affected driver revision; the attack vector is purely local and requires no user interaction. The CVSS 3.1 score of 7.8 (High) reflects high impact on confidentiality, integrity and availability, meaning the flaw can potentially let an unprivileged process read or corrupt memory it should not be able to reach. Anyone running a device whose kernel integrates one of the affected Bifrost, Valhall or 5th Gen Mali driver revisions — typically Arm-based smartphones, tablets and embedded systems built around Mali GPUs — is affected. There is no known public proof of concept, it is not in CISA KEV, and EPSS places the 30-day exploitation probability at roughly 0.1% (4th percentile).

What to do: Inventory which Mali GPU kernel driver revision your fleet's kernels ship with (revisions follow the r<xx>p<n> naming used in the advisory) and upgrade to a release outside the affected ranges as published by Arm; on end devices, apply OS/kernel updates from your device or SoC vendor as they land. Because any local unprivileged process can trigger the flaw, prioritize patching shared and multi-user systems first. No public exploit is known and it is not in CISA KEV, so there is currently no evidence of active exploitation.