CVE-2026-9040

CVE-2026-9040 is a race condition (CWE-362) in Arm's Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers, where concurrent GPU memory processing operations are handled improperly. A local, non-privileged user process can trigger the racing condition through GPU memory operations, without requiring any special privileges or user interaction. Successful exploitation allows the attacker to cause a denial of service (crash/hang of the GPU driver) or disclose sensitive information from GPU memory (CVSS 3.1: 7.7 High, with high confidentiality and availability impact but no integrity impact). Anyone running a Linux/Android kernel with the affected Bifrost (r12p0-r49p5, r50p0-r51p0, r54p1-r54p2), Valhall (r19p0-r49p5, r50p0-r54p3, r55p0), or 5th Gen GPU Architecture (r41p0-r49p5, r50p0-r54p3, r55p0) kernel driver releases is affected, which spans a wide range of Arm-based smartphones, tablets, and embedded boards. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Track Arm's security advisory (CNA: [email protected]) and update the Bifrost, Valhall, and 5th Gen GPU kernel drivers to a fixed release beyond the affected ranges as soon as Arm or your SoC/OEM vendor (e.g., phone or board maker) publishes patched driver packages; apply vendor Android/kernel security updates promptly. Because exploitation requires local unprivileged code execution, prioritize updates on multi-user, kiosk-style, or shared/embedded systems, and verify installed driver revision levels (e.g., via the Mali driver version string reported by the kernel) against the affected ranges.