{"id":"CVE-2026-9034","title":"Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operat…","summary":"Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operat…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"Arm Ltd","product":"Bifrost GPU Userspace Driver","affected":["bifrost_gpu_userspace_driver >= r42p0 <= r49p5","bifrost_gpu_userspace_driver >= r50p0 <= r51p0","bifrost_gpu_userspace_driver >= r54p1 <= r54p3","valhall_gpu_userspace_driver >= r42p0 <= r49p5","valhall_gpu_userspace_driver >= r50p0 <= r54p3","valhall_gpu_userspace_driver r55p0","arm_5th_gen_gpu_architecture_userspace_driver >= r42p0 <= r49p5","arm_5th_gen_gpu_architecture_userspace_driver >= r50p0 <= r54p3","arm_5th_gen_gpu_architecture_userspace_driver r55p0"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:17:42.527","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9034","references":[{"url":"https://support.arm.com/documentation/111552/1-0/?lang=en","label":"arm-security@arm.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T18:02:25.753459Z"},"epss":0.0011,"epssPercentile":0.01438,"ingestedAt":"2026-09-08T15:33:26.986Z","slug":"CVE-2026-9034","body":"## Overview\n\nUse After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory.\n\n\n\nThis issue affects Bifrost GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p3; Valhall GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202631,"id":"CVE-2026-9034","ts":1789400094358,"field":"cvss","old":null,"new":"7.8"},{"seq":202630,"id":"CVE-2026-9034","ts":1789400094358,"field":"severity","old":"none","new":"high"},{"seq":201358,"id":"CVE-2026-9034","ts":1789397621131,"field":"cvss","old":"7.8","new":null},{"seq":201357,"id":"CVE-2026-9034","ts":1789397621131,"field":"severity","old":"high","new":"none"},{"seq":200051,"id":"CVE-2026-9034","ts":1789395586302,"field":"cvss","old":null,"new":"7.8"},{"seq":200050,"id":"CVE-2026-9034","ts":1789395586302,"field":"severity","old":"none","new":"high"},{"seq":199288,"id":"CVE-2026-9034","ts":1789392261161,"field":"cvss","old":"7.8","new":null},{"seq":199287,"id":"CVE-2026-9034","ts":1789392261161,"field":"severity","old":"high","new":"none"},{"seq":197621,"id":"CVE-2026-9034","ts":1789384302736,"field":"cvss","old":null,"new":"7.8"},{"seq":197620,"id":"CVE-2026-9034","ts":1789384302736,"field":"severity","old":"none","new":"high"},{"seq":196895,"id":"CVE-2026-9034","ts":1789383784008,"field":"cvss","old":"7.8","new":null},{"seq":196894,"id":"CVE-2026-9034","ts":1789383784008,"field":"severity","old":"high","new":"none"},{"seq":195799,"id":"CVE-2026-9034","ts":1789380593572,"field":"cvss","old":null,"new":"7.8"},{"seq":195798,"id":"CVE-2026-9034","ts":1789380593572,"field":"severity","old":"none","new":"high"},{"seq":194750,"id":"CVE-2026-9034","ts":1789378790316,"field":"cvss","old":"7.8","new":null},{"seq":194749,"id":"CVE-2026-9034","ts":1789378790316,"field":"severity","old":"high","new":"none"},{"seq":193537,"id":"CVE-2026-9034","ts":1789376535540,"field":"cvss","old":null,"new":"7.8"},{"seq":193536,"id":"CVE-2026-9034","ts":1789376535540,"field":"severity","old":"none","new":"high"},{"seq":192324,"id":"CVE-2026-9034","ts":1789373640134,"field":"cvss","old":"7.8","new":null},{"seq":192323,"id":"CVE-2026-9034","ts":1789373640134,"field":"severity","old":"high","new":"none"},{"seq":191109,"id":"CVE-2026-9034","ts":1789369508355,"field":"cvss","old":null,"new":"7.8"},{"seq":191108,"id":"CVE-2026-9034","ts":1789369508355,"field":"severity","old":"none","new":"high"},{"seq":189896,"id":"CVE-2026-9034","ts":1789368461692,"field":"cvss","old":"7.8","new":null},{"seq":189895,"id":"CVE-2026-9034","ts":1789368461692,"field":"severity","old":"high","new":"none"},{"seq":188679,"id":"CVE-2026-9034","ts":1789365243641,"field":"cvss","old":null,"new":"7.8"},{"seq":188678,"id":"CVE-2026-9034","ts":1789365243641,"field":"severity","old":"none","new":"high"},{"seq":187466,"id":"CVE-2026-9034","ts":1789363481018,"field":"cvss","old":"7.8","new":null},{"seq":187465,"id":"CVE-2026-9034","ts":1789363481018,"field":"severity","old":"high","new":"none"},{"seq":186252,"id":"CVE-2026-9034","ts":1789361247887,"field":"cvss","old":null,"new":"7.8"},{"seq":186251,"id":"CVE-2026-9034","ts":1789361247887,"field":"severity","old":"none","new":"high"},{"seq":185039,"id":"CVE-2026-9034","ts":1789358391568,"field":"cvss","old":"7.8","new":null},{"seq":185038,"id":"CVE-2026-9034","ts":1789358391568,"field":"severity","old":"high","new":"none"},{"seq":183288,"id":"CVE-2026-9034","ts":1789354332300,"field":"cvss","old":null,"new":"7.8"},{"seq":183287,"id":"CVE-2026-9034","ts":1789354332300,"field":"severity","old":"none","new":"high"},{"seq":182081,"id":"CVE-2026-9034","ts":1789353336006,"field":"cvss","old":"7.8","new":null},{"seq":182080,"id":"CVE-2026-9034","ts":1789353336006,"field":"severity","old":"high","new":"none"},{"seq":180874,"id":"CVE-2026-9034","ts":1789350305346,"field":"cvss","old":null,"new":"7.8"},{"seq":180873,"id":"CVE-2026-9034","ts":1789350305346,"field":"severity","old":"none","new":"high"},{"seq":179667,"id":"CVE-2026-9034","ts":1789348309346,"field":"cvss","old":"7.8","new":null},{"seq":179666,"id":"CVE-2026-9034","ts":1789348309346,"field":"severity","old":"high","new":"none"},{"seq":178460,"id":"CVE-2026-9034","ts":1789346385294,"field":"cvss","old":null,"new":"7.8"},{"seq":178459,"id":"CVE-2026-9034","ts":1789346385294,"field":"severity","old":"none","new":"high"},{"seq":177253,"id":"CVE-2026-9034","ts":1789343189312,"field":"cvss","old":"7.8","new":null},{"seq":177252,"id":"CVE-2026-9034","ts":1789343189312,"field":"severity","old":"high","new":"none"},{"seq":175370,"id":"CVE-2026-9034","ts":1789334897896,"field":"cvss","old":null,"new":"7.8"},{"seq":175369,"id":"CVE-2026-9034","ts":1789334897896,"field":"severity","old":"none","new":"high"},{"seq":174165,"id":"CVE-2026-9034","ts":1789333709289,"field":"cvss","old":"7.8","new":null},{"seq":174164,"id":"CVE-2026-9034","ts":1789333709289,"field":"severity","old":"high","new":"none"},{"seq":172979,"id":"CVE-2026-9034","ts":1789331106793,"field":"cvss","old":null,"new":"7.8"},{"seq":172978,"id":"CVE-2026-9034","ts":1789331106793,"field":"severity","old":"none","new":"high"}]}