The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because…
Priority CRITICAL 97Exploited in the wildCWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
Why it matters now
Exploitation Active In CISA KEV since 2023-03-30CISA due date 2023-04-20
EPSS 0.18461 97th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:* | r0p0 – r38p1 | Vulnerable | Arm |
| cpe:2.3:a:arm:bifrost_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* | r39p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:* | r4p0 – r31p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* | r19p0 – r38p1 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* | r39p0 | Vulnerable | Arm |
- cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r0p0 – r38p1 Vulnerable ·Arm
- cpe:2.3:a:arm:bifrost_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* Versions r39p0 Vulnerable ·Arm
- cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r4p0 – r31p0 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r19p0 – r38p1 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_kernel_driver:r39p0:*:*:*:*:*:*:* Versions r39p0 Vulnerable ·Arm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2023-03-30 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2022-38181
- 2026-10-03 Alias added: GHSA-h73c-qgg5-q5rp
References
Exploit 2
More Arm Bifrost Gpu Kernel Driver vulnerabilities
- TI-2021-10068 . KEVCVSS 3.1HIGH 8.8
- TI-2021-09732 The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory… KEVCVSS 3.1HIGH 8.8
- TI-2021-09731 The Arm Mali GPU kernel driver allows privilege escalation or information disclosure… KEVCVSS 3.1HIGH 8.8
- TI-2024-04292 Mali GPU Kernel Driver allows improper GPU memory processing operations KEVCVSS 3.1HIGH 7.8
- TI-2022-06958 Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to… KEVCVSS 3.1HIGH 7.8
- TI-2023-03898 Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations KEVCVSS 3.1MEDIUM 5.5
Sources
- CVE-2022-38181 · CVE Program
- CVE-2022-38181 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-h73c-qgg5-q5rp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences