An issue was discovered in the Arm Mali GPU Kernel Driver.
Priority LOW 31CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.
Why it matters now
EPSS 0.01204 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:* | r0p0 – r38p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:bifrost_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* | r39p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:* | r4p0 – r32p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* | r19p0 – r38p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* | r39p0 | Vulnerable | Arm |
- cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r0p0 – r38p0 Vulnerable ·Arm
- cpe:2.3:a:arm:bifrost_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* Versions r39p0 Vulnerable ·Arm
- cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r4p0 – r32p0 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r19p0 – r38p0 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* Versions r39p0 Vulnerable ·Arm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-36449
- 2026-10-03 Alias added: GHSA-ff7h-mhv4-853x
References
Advisory 5
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
- http://packetstormsecurity.com/files/168432/Arm-Mali-Physical-Address-Exposure.html
- http://packetstormsecurity.com/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.html
- http://packetstormsecurity.com/files/168434/Arm-Mali-CSF-Missing-Buffer-Size-Check.html
- http://packetstormsecurity.com/files/168433/Arm-Mali-Race-Condition.html
More Arm Bifrost Gpu Kernel Driver vulnerabilities
- TI-2022-17875 The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because… KEVCVSS 3.1HIGH 8.8
- TI-2021-10068 . KEVCVSS 3.1HIGH 8.8
- TI-2021-09732 The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory… KEVCVSS 3.1HIGH 8.8
- TI-2021-09731 The Arm Mali GPU kernel driver allows privilege escalation or information disclosure… KEVCVSS 3.1HIGH 8.8
- TI-2024-04292 Mali GPU Kernel Driver allows improper GPU memory processing operations KEVCVSS 3.1HIGH 7.8
- TI-2022-06958 Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2022-36449 · CVE Program
- CVE-2022-36449 · NVD
- FIRST EPSS
- GHSA-ff7h-mhv4-853x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences