This vulnerability is a Use After Free flaw (CWE‑416) in the kernel code of Arm Ltd’s Bifrost, Valhall, and 5th Generation GPU Architecture drivers. A local, non‑privileged user can issue valid GPU memory processing commands that read data that has already been freed. The consequence is the disclosure of confidential information that was residing in GPU memory; the flaw does not give the attacker code execution or privilege escalation within the host.

Affected drivers are Arm Ltd:Arm 5th Gen GPU Architecture Kernel Driver, Arm Ltd:Bifrost GPU Kernel Driver, and Arm Ltd:Valhall GPU Kernel Driver. The vulnerable releases include Bifrost from r44p0–r49p4, r50p0–r51p0, and r54p1–r54p2; Valhall from r44p0–r49p5, r50p0–r54p3; and the 5th Gen Architecture from r44p0–r49p5, r50p0–r54p3, and r55p0.

The CVSS score of 7.8 reflects a high‑severity local flaw. Because it requires the attacker to be a non‑privileged user with GPU access, it is not readily exploitable over the network. The EPSS score of < 1% indicates a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known mass‑exploitation activity has been reported. The risk remains significant for systems that expose GPU functionality to untrusted processes, as the memory disclosure could be leveraged in further attacks.