CVE-2026-9034

CVE-2026-9034 is a use-after-free (CWE-416) in the Arm Bifrost, Valhall, and Arm 5th Gen GPU Architecture userspace drivers, the driver software shipped for Arm Mali-architecture GPUs. A non-privileged local process can trigger the flaw simply by performing valid GPU processing operations, including WebGL or WebGPU workloads from web content, causing the driver to access already-freed memory. Depending on conditions this can lead to information disclosure, memory corruption, or crashes, reflected in the CVSS 3.1 score of 7.8 (high) with high impact to confidentiality, integrity, and availability, a local attack vector, low privileges required, and no user interaction. Any system shipping the affected driver releases is exposed, most plausibly Android phones and tablets, Chromebooks, and other Arm SoC-based devices using these Mali GPU generations, with the actual population depending on the driver versions individual vendors shipped. There is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS assigns roughly a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Patch the GPU userspace driver to a release outside the affected ranges (for Bifrost, later than r51p0 or r54p3 depending on branch; for Valhall and Arm 5th Gen, later than r55p0), which on Android and Chrome OS typically arrives through device/OS vendor security updates and on Linux through the vendor's driver distribution. Inventory affected endpoints by checking Arm Mali driver version strings and vendor security bulletins, prioritizing systems that run untrusted web content since WebGL/WebGPU workloads can trigger the flaw; no workarounds are documented.