What is CVE-2026-11891?

CVE-2026-11891 is a medium-severity vulnerability in Arm Ltd 5th Gen GPU Architecture Userspace Driver, classified under Use After Free. CVSS score: 5.1/10. Published 2026-09-08.

How severe is CVE-2026-11891?

Medium severity. CVSS v3 base score is 5.1 out of 10.

Use After Free in Arm Ltd 5th Gen GPU Architecture Userspace Driver

CVE-2026-11891

Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory. This issue affects Valhall GPU Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0.

Vulnerability class: Use-After-Free

Published 2026-09-08 · last modified 2026-09-10.

CVSS v3 metric

CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.001 (1.2th percentile), scored 2026-10-24.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000

Affected products

Arm Ltd 5th Gen GPU Architecture Userspace Driver — versions r55p0
Arm Ltd Valhall GPU Userspace Driver — versions r55p0

Weakness classification (CWE)

CWE-416 — Use After Free

References

support.arm.com/documentation/111552/1-0/

Frequently asked questions

What is CVE-2026-11891?: CVE-2026-11891 is a medium-severity vulnerability in Arm Ltd 5th Gen GPU Architecture Userspace Driver, classified under Use After Free. CVSS score: 5.1/10. Published 2026-09-08.
How severe is CVE-2026-11891?: Medium severity. CVSS v3 base score is 5.1 out of 10.