CVE-2025-3212
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and Arm 5th Gen GPU Architecture Kernel Drivers allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory. Affects versions r41p0 through r49p4 and r50p0 through r51p0 (Bifrost) and through r54p0 (Valhall, 5th Gen).
Risk Assessment
A local unprivileged attacker could exploit access to freed memory, potentially leading to privilege escalation or data disclosure. However, local access to the system is required.
Recommendation
Update the GPU drivers to a patched version. Restrict the ability to run unprivileged processes on devices with these GPUs.
Other vulnerabilities in Arm GPU Kernel Driver
See all- CVE-2026-0001Medium
Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory via valid GPU memory processing operations.
- CVE-2026-9040High
A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause a denial of service or disclose sensitive information. This issue affects Bifrost GPU Kernel Driver: from r12p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r19p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.
- CVE-2026-7477High
Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing valid GPU memory processing operations.
- CVE-2026-7476High
Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing improper GPU memory processing operations.
- CVE-2026-5729High
Use After Free vulnerability in Arm Ltd Valhall and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing valid GPU processing operations.
- CVE-2026-12387Medium
Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing valid GPU memory processing operations.
- CVE-2026-12285Medium
Use After Free vulnerability in Arm Ltd GPU kernel drivers (Bifrost, Valhall, Arm 5th Gen) allows a local non-privileged process to access already freed memory via valid GPU memory processing operations.
- CVE-2026-0860High
Exposure of sensitive information vulnerability in Arm Ltd GPU kernel drivers (Valhall, Arm 5th Gen) allows a local non-privileged process to gain access to sensitive kernel information via improper GPU memory processing operations.
- CVE-2025-8045Medium
A use-after-free vulnerability exists in Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver (r53p0 through r54p1). A local non-privileged user process can perform improper GPU processing operations to access already freed memory.
Original NVD description (English source)
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p4, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS