CVE-2026-11891
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Use After Free vulnerability in Arm Ltd GPU userspace drivers (Valhall, Arm 5th Gen) allows a non-privileged process to access already freed memory via valid GPU operations, including via WebGL or WebGPU.
Risk Assessment
An attacker could exploit this remotely (e.g., via a browser) to compromise data confidentiality or integrity, potentially leading to code execution in the browser context.
Recommendation
Update Arm GPU userspace drivers to patched versions (e.g., r49p6 or later, r54p4 or later) and restrict WebGL/WebGPU access in untrusted environments.
Other vulnerabilities in Arm GPU Userspace Driver
Original NVD description (English source)
Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory. This issue affects Valhall GPU Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS