{"id":"CVE-2026-7476","title":"Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing…","summary":"Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"Arm Ltd","product":"Bifrost GPU Kernel Driver","affected":["bifrost_gpu_kernel_driver >= r49p3 <= r49p5","bifrost_gpu_kernel_driver r51p0","bifrost_gpu_kernel_driver >= r54p1 <= r54p2","valhall_gpu_kernel_driver >= r49p3 <= r49p5","valhall_gpu_kernel_driver >= r51p0 <= r54p3","valhall_gpu_kernel_driver r55p0","arm_5th_gen_gpu_architecture_kernel_driver >= r49p3 <= r49p5","arm_5th_gen_gpu_architecture_kernel_driver >= r51p0 <= r54p3","arm_5th_gen_gpu_architecture_kernel_driver r55p0"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:17:35.223","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7476","references":[{"url":"https://support.arm.com/documentation/111552/1-0/?lang=en","label":"arm-security@arm.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T18:13:57.125298Z"},"epss":0.00162,"epssPercentile":0.04674,"ingestedAt":"2026-09-08T15:33:26.986Z","slug":"CVE-2026-7476","body":"## Overview\n\nUse After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to access already freed memory.\n\n\n\nThis issue affects Bifrost GPU Kernel Driver: from r49p3 through r49p5, r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r49p3 through r49p5, from r51p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r49p3 through r49p5, from r51p0 through r54p3, r55p0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201903,"id":"CVE-2026-7476","ts":1789399980667,"field":"cvss","old":null,"new":"7.8"},{"seq":201902,"id":"CVE-2026-7476","ts":1789399980667,"field":"severity","old":"none","new":"high"},{"seq":200633,"id":"CVE-2026-7476","ts":1789397539605,"field":"cvss","old":"7.8","new":null},{"seq":200632,"id":"CVE-2026-7476","ts":1789397539605,"field":"severity","old":"high","new":"none"},{"seq":199347,"id":"CVE-2026-7476","ts":1789395469312,"field":"cvss","old":null,"new":"7.8"},{"seq":199346,"id":"CVE-2026-7476","ts":1789395469312,"field":"severity","old":"none","new":"high"},{"seq":198592,"id":"CVE-2026-7476","ts":1789392141236,"field":"cvss","old":"7.8","new":null},{"seq":198591,"id":"CVE-2026-7476","ts":1789392141236,"field":"severity","old":"high","new":"none"},{"seq":198547,"id":"CVE-2026-7476","ts":1789392066367,"field":"cvss","old":null,"new":"7.8"},{"seq":198546,"id":"CVE-2026-7476","ts":1789392066367,"field":"severity","old":"none","new":"high"},{"seq":196338,"id":"CVE-2026-7476","ts":1789383713322,"field":"cvss","old":"7.8","new":null},{"seq":196337,"id":"CVE-2026-7476","ts":1789383713322,"field":"severity","old":"high","new":"none"},{"seq":195267,"id":"CVE-2026-7476","ts":1789380544521,"field":"cvss","old":null,"new":"7.8"},{"seq":195266,"id":"CVE-2026-7476","ts":1789380544521,"field":"severity","old":"none","new":"high"},{"seq":194054,"id":"CVE-2026-7476","ts":1789378651108,"field":"cvss","old":"7.8","new":null},{"seq":194053,"id":"CVE-2026-7476","ts":1789378651108,"field":"severity","old":"high","new":"none"},{"seq":192841,"id":"CVE-2026-7476","ts":1789376481672,"field":"cvss","old":null,"new":"7.8"},{"seq":192840,"id":"CVE-2026-7476","ts":1789376481672,"field":"severity","old":"none","new":"high"},{"seq":191628,"id":"CVE-2026-7476","ts":1789373558234,"field":"cvss","old":"7.8","new":null},{"seq":191627,"id":"CVE-2026-7476","ts":1789373558234,"field":"severity","old":"high","new":"none"},{"seq":190413,"id":"CVE-2026-7476","ts":1789369422169,"field":"cvss","old":null,"new":"7.8"},{"seq":190412,"id":"CVE-2026-7476","ts":1789369422169,"field":"severity","old":"none","new":"high"},{"seq":189200,"id":"CVE-2026-7476","ts":1789368349508,"field":"cvss","old":"7.8","new":null},{"seq":189199,"id":"CVE-2026-7476","ts":1789368349508,"field":"severity","old":"high","new":"none"},{"seq":187983,"id":"CVE-2026-7476","ts":1789365204817,"field":"cvss","old":null,"new":"7.8"},{"seq":187982,"id":"CVE-2026-7476","ts":1789365204817,"field":"severity","old":"none","new":"high"},{"seq":186770,"id":"CVE-2026-7476","ts":1789363415111,"field":"cvss","old":"7.8","new":null},{"seq":186769,"id":"CVE-2026-7476","ts":1789363415111,"field":"severity","old":"high","new":"none"},{"seq":185556,"id":"CVE-2026-7476","ts":1789361186126,"field":"cvss","old":null,"new":"7.8"},{"seq":185555,"id":"CVE-2026-7476","ts":1789361186126,"field":"severity","old":"none","new":"high"},{"seq":184343,"id":"CVE-2026-7476","ts":1789358277997,"field":"cvss","old":"7.8","new":null},{"seq":184342,"id":"CVE-2026-7476","ts":1789358277997,"field":"severity","old":"high","new":"none"},{"seq":182594,"id":"CVE-2026-7476","ts":1789354279295,"field":"cvss","old":null,"new":"7.8"},{"seq":182593,"id":"CVE-2026-7476","ts":1789354279295,"field":"severity","old":"none","new":"high"},{"seq":181387,"id":"CVE-2026-7476","ts":1789353250270,"field":"cvss","old":"7.8","new":null},{"seq":181386,"id":"CVE-2026-7476","ts":1789353250270,"field":"severity","old":"high","new":"none"},{"seq":180180,"id":"CVE-2026-7476","ts":1789350233130,"field":"cvss","old":null,"new":"7.8"},{"seq":180179,"id":"CVE-2026-7476","ts":1789350233130,"field":"severity","old":"none","new":"high"},{"seq":178973,"id":"CVE-2026-7476","ts":1789348226459,"field":"cvss","old":"7.8","new":null},{"seq":178972,"id":"CVE-2026-7476","ts":1789348226459,"field":"severity","old":"high","new":"none"},{"seq":177766,"id":"CVE-2026-7476","ts":1789346347176,"field":"cvss","old":null,"new":"7.8"},{"seq":177765,"id":"CVE-2026-7476","ts":1789346347176,"field":"severity","old":"none","new":"high"},{"seq":176559,"id":"CVE-2026-7476","ts":1789343132752,"field":"cvss","old":"7.8","new":null},{"seq":176558,"id":"CVE-2026-7476","ts":1789343132752,"field":"severity","old":"high","new":"none"},{"seq":174676,"id":"CVE-2026-7476","ts":1789334844007,"field":"cvss","old":null,"new":"7.8"},{"seq":174675,"id":"CVE-2026-7476","ts":1789334844007,"field":"severity","old":"none","new":"high"},{"seq":173471,"id":"CVE-2026-7476","ts":1789333625733,"field":"cvss","old":"7.8","new":null},{"seq":173470,"id":"CVE-2026-7476","ts":1789333625733,"field":"severity","old":"high","new":"none"},{"seq":172285,"id":"CVE-2026-7476","ts":1789331070830,"field":"cvss","old":null,"new":"7.8"},{"seq":172284,"id":"CVE-2026-7476","ts":1789331070830,"field":"severity","old":"none","new":"high"}]}