CVE-2026-9034
Mali GPU Userspace Driver allows access to already freed memory
Reported by arm · Published September 8, 2026
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory. This issue affects Bifrost GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p3; Valhall GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Valhall GPU Userspace Driver | Arm Ltd | r54p3, r49p5 |
| Bifrost GPU Userspace Driver | Arm Ltd | r54p3, r51p0, r49p5 |
| Arm 5th Gen GPU Architecture Userspace Driver | Arm Ltd | r54p3, r49p5 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Arm Ltd | Bifrost GPU Userspace Driver | r42p0, r50p0, r54p1 |
| Arm Ltd | Valhall GPU Userspace Driver | r42p0, r50p0, r55p0 |
| Arm Ltd | Arm 5th Gen GPU Architecture Userspace Driver | r42p0, r50p0, r55p0 |
| Arm Ltd | Valhall GPU Userspace Driver | *, *, * |
| Arm Ltd | Bifrost GPU Userspace Driver | *, *, * |
| Arm Ltd | Arm 5th Gen GPU Architecture Userspace Driver | *, *, * |
Timeline
- Sep 8, 2026 CVE Published
- Sep 9, 2026 EPSS Score (7 in total, the first dated here)
- Sep 10, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-9034
vulnetix vdb fixes CVE-2026-9034Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-9034/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart