The flaw permits a local non‑privileged user process to trigger GPU memory operations that expose kernel memory contents written by the driver data, a classic information‑disclosure vulnerability classified as CWE‑200.

The flaw affects two families of Arm Ltd GPU kernel drivers. The Valhall GPU Kernel Driver is vulnerable in releases r29p0 through r49p5, then from r50p0 through r54p3, and r55p0. The Arm 5th Gen GPU Architecture Kernel Driver is vulnerable in releases r41p0 through r49p5, from r50p0 through r54p3, and r55p0.

The CVSS score is 7.5, indicating a moderate‑to‑high severity. Its EPSS score is less than 1%, reflecting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack can be performed by any local non‑privileged user without privilege escalation, exposing kernel‑level data to the attacker.