{"id":"CVE-2026-11891","title":"Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, t…","summary":"Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, t…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-416"],"vendor":"Arm Ltd","product":"Valhall GPU Userspace Driver","affected":["valhall_gpu_userspace_driver >= r46p0 <= r49p5","valhall_gpu_userspace_driver >= r50p0 <= r54p3","valhall_gpu_userspace_driver r55p0","arm_5th_gen_gpu_architecture_userspace_driver >= r46p0 <= r49p5","arm_5th_gen_gpu_architecture_userspace_driver >= r50p0 <= r54p3","arm_5th_gen_gpu_architecture_userspace_driver r55p0"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:17:26.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11891","references":[{"url":"https://support.arm.com/documentation/111552/1-0/?lang=en","label":"arm-security@arm.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T18:28:09.653159Z"},"epss":0.00109,"epssPercentile":0.01411,"ingestedAt":"2026-09-08T15:33:26.985Z","slug":"CVE-2026-11891","body":"## Overview\n\nUse After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory.\n\n\n\nThis issue affects Valhall GPU Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201457,"id":"CVE-2026-11891","ts":1789399467049,"field":"cvss","old":null,"new":"5.1"},{"seq":201456,"id":"CVE-2026-11891","ts":1789399467049,"field":"severity","old":"none","new":"medium"},{"seq":200191,"id":"CVE-2026-11891","ts":1789396927886,"field":"cvss","old":"5.1","new":null},{"seq":200190,"id":"CVE-2026-11891","ts":1789396927886,"field":"severity","old":"medium","new":"none"},{"seq":198112,"id":"CVE-2026-11891","ts":1789387969351,"field":"cvss","old":null,"new":"5.1"},{"seq":198111,"id":"CVE-2026-11891","ts":1789387969351,"field":"severity","old":"none","new":"medium"},{"seq":195908,"id":"CVE-2026-11891","ts":1789383305878,"field":"cvss","old":"5.1","new":null},{"seq":195907,"id":"CVE-2026-11891","ts":1789383305878,"field":"severity","old":"medium","new":"none"},{"seq":194837,"id":"CVE-2026-11891","ts":1789380273392,"field":"cvss","old":null,"new":"5.1"},{"seq":194836,"id":"CVE-2026-11891","ts":1789380273392,"field":"severity","old":"none","new":"medium"},{"seq":193624,"id":"CVE-2026-11891","ts":1789378167922,"field":"cvss","old":"5.1","new":null},{"seq":193623,"id":"CVE-2026-11891","ts":1789378167922,"field":"severity","old":"medium","new":"none"},{"seq":192411,"id":"CVE-2026-11891","ts":1789376192082,"field":"cvss","old":null,"new":"5.1"},{"seq":192410,"id":"CVE-2026-11891","ts":1789376192082,"field":"severity","old":"none","new":"medium"},{"seq":191198,"id":"CVE-2026-11891","ts":1789373039694,"field":"cvss","old":"5.1","new":null},{"seq":191197,"id":"CVE-2026-11891","ts":1789373039694,"field":"severity","old":"medium","new":"none"},{"seq":189983,"id":"CVE-2026-11891","ts":1789369094829,"field":"cvss","old":null,"new":"5.1"},{"seq":189982,"id":"CVE-2026-11891","ts":1789369094829,"field":"severity","old":"none","new":"medium"},{"seq":188770,"id":"CVE-2026-11891","ts":1789367990356,"field":"cvss","old":"5.1","new":null},{"seq":188769,"id":"CVE-2026-11891","ts":1789367990356,"field":"severity","old":"medium","new":"none"},{"seq":187553,"id":"CVE-2026-11891","ts":1789364947599,"field":"cvss","old":null,"new":"5.1"},{"seq":187552,"id":"CVE-2026-11891","ts":1789364947599,"field":"severity","old":"none","new":"medium"},{"seq":186340,"id":"CVE-2026-11891","ts":1789362907561,"field":"cvss","old":"5.1","new":null},{"seq":186339,"id":"CVE-2026-11891","ts":1789362907561,"field":"severity","old":"medium","new":"none"},{"seq":185126,"id":"CVE-2026-11891","ts":1789360932856,"field":"cvss","old":null,"new":"5.1"},{"seq":185125,"id":"CVE-2026-11891","ts":1789360932856,"field":"severity","old":"none","new":"medium"},{"seq":183913,"id":"CVE-2026-11891","ts":1789357851945,"field":"cvss","old":"5.1","new":null},{"seq":183912,"id":"CVE-2026-11891","ts":1789357851945,"field":"severity","old":"medium","new":"none"},{"seq":182165,"id":"CVE-2026-11891","ts":1789354058003,"field":"cvss","old":null,"new":"5.1"},{"seq":182164,"id":"CVE-2026-11891","ts":1789354058003,"field":"severity","old":"none","new":"medium"},{"seq":180958,"id":"CVE-2026-11891","ts":1789352879454,"field":"cvss","old":"5.1","new":null},{"seq":180957,"id":"CVE-2026-11891","ts":1789352879454,"field":"severity","old":"medium","new":"none"},{"seq":179751,"id":"CVE-2026-11891","ts":1789349952583,"field":"cvss","old":null,"new":"5.1"},{"seq":179750,"id":"CVE-2026-11891","ts":1789349952583,"field":"severity","old":"none","new":"medium"},{"seq":178544,"id":"CVE-2026-11891","ts":1789347714586,"field":"cvss","old":"5.1","new":null},{"seq":178543,"id":"CVE-2026-11891","ts":1789347714586,"field":"severity","old":"medium","new":"none"},{"seq":177337,"id":"CVE-2026-11891","ts":1789346139387,"field":"cvss","old":null,"new":"5.1"},{"seq":177336,"id":"CVE-2026-11891","ts":1789346139387,"field":"severity","old":"none","new":"medium"},{"seq":176130,"id":"CVE-2026-11891","ts":1789342649298,"field":"cvss","old":"5.1","new":null},{"seq":176129,"id":"CVE-2026-11891","ts":1789342649298,"field":"severity","old":"medium","new":"none"},{"seq":175916,"id":"CVE-2026-11891","ts":1789342262803,"field":"cvss","old":null,"new":"5.1"},{"seq":175915,"id":"CVE-2026-11891","ts":1789342262803,"field":"severity","old":"none","new":"medium"},{"seq":175454,"id":"CVE-2026-11891","ts":1789338287270,"field":"cvss","old":"5.1","new":null},{"seq":175453,"id":"CVE-2026-11891","ts":1789338287270,"field":"severity","old":"medium","new":"none"},{"seq":174249,"id":"CVE-2026-11891","ts":1789334562206,"field":"cvss","old":null,"new":"5.1"},{"seq":174248,"id":"CVE-2026-11891","ts":1789334562206,"field":"severity","old":"none","new":"medium"},{"seq":173044,"id":"CVE-2026-11891","ts":1789333138179,"field":"cvss","old":"5.1","new":null},{"seq":173043,"id":"CVE-2026-11891","ts":1789333138179,"field":"severity","old":"medium","new":"none"},{"seq":171858,"id":"CVE-2026-11891","ts":1789330838668,"field":"cvss","old":null,"new":"5.1"},{"seq":171857,"id":"CVE-2026-11891","ts":1789330838668,"field":"severity","old":"none","new":"medium"}]}