CVE-2025-0073
📋 TL;DR
A Use After Free vulnerability in Arm's Valhall and 5th Gen GPU kernel drivers allows a local non-privileged user to access freed memory through improper GPU memory processing. This affects devices using these GPU drivers from version r53p0 up to but not including r54p0. Attackers could potentially escalate privileges or cause system instability.
💻 Affected Systems
- Arm Ltd Valhall GPU Kernel Driver
- Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level access, allowing complete system compromise, data theft, or persistent malware installation.
Likely Case
Local privilege escalation enabling unauthorized access to system resources, potential denial of service through system crashes, or information disclosure.
If Mitigated
Limited impact with proper access controls, but still risk of system instability or information leakage from freed memory.
🎯 Exploit Status
Requires local access and knowledge of GPU memory operations. No public exploit code known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: r54p0
Vendor Advisory: https://developer.arm.com/documentation/110466/latest/
Restart Required: Yes
Instructions:
1. Check current GPU driver version. 2. Update to r54p0 or later. 3. For Android devices, wait for OEM security updates. 4. For Linux systems, update kernel or GPU driver packages. 5. Reboot system after update.
🔧 Temporary Workarounds
Restrict local user access
allLimit non-privileged user accounts on affected systems to reduce attack surface
Disable unnecessary GPU features
linuxReduce GPU functionality to minimize attack vectors if possible
🧯 If You Can't Patch
- Implement strict access controls and limit local user privileges
- Monitor systems for unusual GPU-related activity or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check GPU driver version via 'cat /sys/class/misc/mali0/device/driver/version' or similar system-specific commandsCheck Version:
cat /sys/class/misc/mali0/device/driver/version 2>/dev/null || echo 'Check system-specific GPU driver documentation'Verify Fix Applied:
Verify driver version is r54p0 or later using the same version check command📡 Detection & Monitoring
Log Indicators:
- Kernel panic or oops messages related to GPU/mali driver
- Unusual privilege escalation attempts
- Failed GPU memory operations in system logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="kernel" AND ("mali" OR "GPU" OR "use-after-free") AND severity>=medium