CVE-2026-9040

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in Arm GPU Kernel Drivers Causes DoS or Information Disclosure

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Arm Limited

Description

A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause a denial of service or disclose sensitive information. This issue affects Bifrost GPU Kernel Driver: from r12p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r19p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-9040

Affected Vendors & Products

Vendor	Product	Version / Range
arm_ltd	bifrost_gpu_kernel_driver	From r12p0 (inc) to r49p5 (inc)
arm_ltd	bifrost_gpu_kernel_driver	From r50p0 (inc) to r51p0 (inc)
arm_ltd	bifrost_gpu_kernel_driver	From r54p1 (inc) to r54p2 (inc)
arm_ltd	valhall_gpu_kernel_driver	From r19p0 (inc) to r49p5 (inc)
arm_ltd	valhall_gpu_kernel_driver	From r50p0 (inc) to r54p3 (inc)
arm_ltd	valhall_gpu_kernel_driver	From r55p0 (inc)
arm_ltd	arm_5th_gen_gpu_architecture_kernel_driver	From r41p0 (inc) to r49p5 (inc)
arm_ltd	arm_5th_gen_gpu_architecture_kernel_driver	From r50p0 (inc) to r54p3 (inc)
arm_ltd	arm_5th_gen_gpu_architecture_kernel_driver	From r55p0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in Arm's GPU kernel drivers. It allows a local non-privileged user process to improperly process GPU memory, potentially causing a denial of service or exposing sensitive information.

Impact Analysis

If exploited, this could let an attacker crash your system or access confidential data. It requires local access but could disrupt operations or leak sensitive information from affected devices.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR or HIPAA if sensitive data is exposed. Organizations must address it to maintain compliance.

Mitigation Strategies

Update affected GPU kernel drivers to versions beyond the specified vulnerable ranges. For Bifrost, use r49p5 or later, r50p0 or later, or r54p3 or later. For Valhall, use r49p5 or later, r54p4 or later, or r55p0 or later. For Arm 5th Gen, use r49p5 or later, r54p4 or later, or r55p0 or later.

Hi! I’m here to help you understand CVE-2026-9040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70