CVE-2022-38181
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 18% (percentile: 97) as of 2 November 2026
- CWE
- CWE-416
Affected products
arm: bifrost gpu kernel driver; arm: midgard gpu kernel driver; arm: valhall gpu kernel driver
References
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnera… Vendor Advisory
- https://developer.arm.com/support/arm-security-updates Vendor Advisory
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnera… Vendor Advisory
- https://developer.arm.com/support/arm-security-updates Vendor Advisory
- https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bu… ExploitThird Party Advisory
- https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/ ExploitThird Party Advisory
- https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bu… ExploitThird Party Advisory
- https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/ ExploitThird Party Advisory
- http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code… Third Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code… Third Party AdvisoryVDB Entry