CVE-2025-0072

Published May 2, 2025

Last updated 20 days ago

Arm

Valhall

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-0072 is a use-after-free vulnerability found in the Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. It allows a local, non-privileged user process to perform improper GPU memory processing operations, potentially gaining access to memory that has already been freed. This vulnerability affects the Valhall GPU Kernel Driver versions r29p0 through r49p3, and r50p0 through r53p0, as well as the Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r49p3, and r50p0 through r53p0. It was patched in Mali driver version r54p0, released on May 2, 2025, and was included in Android's May 2025 security update.

Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.
Source: arm-security@arm.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

arm-security@arm.com: CWE-416
nvd@nist.gov: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8ACF6697-A7EB-4131-937C-AC3A1FB49923",
            "versionEndIncluding": "r49p3",
            "versionStartIncluding": "r41p0"
          },
          {
            "criteria": "cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "20FA69E1-1B9E-423E-859D-D47526D843DD",
            "versionEndIncluding": "r53p0",
            "versionStartIncluding": "r50p0"
          },
          {
            "criteria": "cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "28768B33-00EF-4196-8E9F-7A2D7C33C01C",
            "versionEndIncluding": "r49p3",
            "versionStartIncluding": "r29p0"
          },
          {
            "criteria": "cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5CF9F3C4-CF1F-4A2B-B6C9-2CA9F8658B84",
            "versionEndIncluding": "r53p0",
            "versionStartIncluding": "r50p0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.