Mali GPU Userspace Driver allows access to already freed memory
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Arm | Bifrost GPU Userspace Driver | r48p0 – r49p3; r50p0 – r51p0 | — | No fix listed | CNA |
| Arm | Valhall GPU Userspace Driver | r48p0 – r49p3; r50p0 – r54p0 | — | No fix listed | CNA |
| Arm | Arm 5th Gen GPU Architecture Userspace Driver | r48p0 – r49p3; r50p0 – r54p0 | — | No fix listed | CNA |
- Bifrost GPU Userspace Driver VendorArm Affected r48p0 – r49p3; r50p0 – r51p0 Fixed in — No fix listed CNA
- Valhall GPU Userspace Driver VendorArm Affected r48p0 – r49p3; r50p0 – r54p0 Fixed in — No fix listed CNA
- Arm 5th Gen GPU Architecture Userspace Driver VendorArm Affected r48p0 – r49p3; r50p0 – r54p0 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arm:5th_gen_gpu_architecture_userspace_driver:*:*:*:*:*:*:*:* | r48p0 to before r49p4; r50p0 to before r54p1 | Vulnerable | Arm |
| cpe:2.3:a:arm:bifrost_gpu_userspace_driver:*:*:*:*:*:*:*:* | r48p0 to before r49p4; r50p0 to before r54p1 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_userspace_driver:*:*:*:*:*:*:*:* | r48p0 to before r49p4; r50p0 to before r54p1 | Vulnerable | Arm |
- cpe:2.3:a:arm:5th_gen_gpu_architecture_userspace_driver:*:*:*:*:*:*:*:* Versions r48p0 to before r49p4; r50p0 to before r54p1 Vulnerable ·Arm
- cpe:2.3:a:arm:bifrost_gpu_userspace_driver:*:*:*:*:*:*:*:* Versions r48p0 to before r49p4; r50p0 to before r54p1 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_userspace_driver:*:*:*:*:*:*:*:* Versions r48p0 to before r49p4; r50p0 to before r54p1 Vulnerable ·Arm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0932
- 2026-10-03 Alias added: GHSA-mh44-5f8w-px3g
References
More Arm 5th Gen Gpu Architecture Userspace Driver vulnerabilities
- TI-2025-01066 Mali GPU Userspace Driver allows an Out-of-Bounds access CVSS 3.1HIGH 7.8
- TI-2025-00027 Mali GPU Userspace Driver allows an Out-of-Bounds access CVSS 3.1MEDIUM 5.9
Sources
- CVE-2025-0932 · CVE Program
- CVE-2025-0932 · NVD
- FIRST EPSS
- GHSA-mh44-5f8w-px3g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences