CVE-2026-7477

CVE-2026-7477 is a use-after-free flaw (CWE-416) in Arm's Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers that lets a local, non-privileged process access GPU memory that has already been freed while performing otherwise valid GPU memory processing operations. It is triggered entirely from local code with low privileges and no user interaction, and a kernel-level use-after-free of this kind typically enables privilege escalation or arbitrary code execution, consistent with the high confidentiality, integrity and availability scores in its 7.8 (high) CVSS. Affected systems are those shipping the listed Arm GPU kernel driver releases — most commonly Android smartphones, tablets and other ARM-based devices using Mali-class GPUs integrated by SoC and device vendors. Exploitation status is quiet: there is no known public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Update affected Arm GPU kernel drivers to a fixed release outside the listed r-series ranges — or install device/SoC-vendor (e.g., OEM, Android) security updates carrying the patched driver — consulting Arm's advisory for the exact fixed revisions, since fixed versions are not specified in this data. To assess exposure, inventory ARM endpoints (especially Android fleets and shared ARM systems) and check the installed Mali kernel driver revision against the affected ranges; note the issue requires only low local privileges, so multi-user endpoints are the priority. No workaround is provided in the data, and with no known exploitation or public PoC, standard patch-cycle remediation is appropriate.