CVE-2025-0072: Arm 5th Gen GPU Driver Use-After-Free Flaw

CVE-2025-0072 Overview

CVE-2025-0072 is a Use After Free vulnerability affecting Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. This memory corruption vulnerability allows a local non-privileged user process to perform improper GPU memory processing operations, enabling access to already freed memory regions.

Critical Impact

Local attackers with low privileges can exploit improper GPU memory handling to access freed memory, potentially achieving privilege escalation, arbitrary code execution, or sensitive information disclosure on affected systems.

Affected Products

• Arm Valhall GPU Kernel Driver versions r29p0 through r49p3
• Arm Valhall GPU Kernel Driver versions r50p0 through r53p0
• Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r49p3
• Arm 5th Gen GPU Architecture Kernel Driver versions r50p0 through r53p0

Discovery Timeline

• 2025-05-02 - CVE-2025-0072 published to NVD
• 2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-0072

Vulnerability Analysis

This Use After Free (CWE-416) vulnerability exists within the GPU memory management subsystem of Arm's kernel drivers. The flaw occurs when GPU memory operations improperly handle memory lifecycle management, allowing references to persist after the associated memory has been deallocated and potentially reallocated for other purposes.

The vulnerability requires local access with low privileges, meaning an attacker must have the ability to execute code on the target system. Once exploited, the attacker can leverage the dangling reference to manipulate or read memory that has been freed and potentially reassigned, which can lead to information disclosure, memory corruption, or code execution within the kernel context.

Systems utilizing Arm Mali GPUs with Valhall architecture or 5th Generation GPU architecture are particularly at risk, including many Android mobile devices, Chromebooks, and embedded systems that rely on these graphics processors.

Root Cause

The root cause of CVE-2025-0072 lies in improper memory management within the GPU kernel driver's memory processing operations. Specifically, the driver fails to properly invalidate or clear references to GPU memory buffers after they have been freed. This creates a use-after-free condition where subsequent memory operations can reference and manipulate memory regions that are no longer validly allocated, leading to undefined behavior and potential security compromise.

Attack Vector

The attack requires local access to the target system. An attacker with non-privileged user access can craft specific GPU memory operations that trigger the use-after-free condition. By carefully timing memory allocations and deallocations, the attacker can cause the driver to access freed memory.

The exploitation process typically involves:

1. Allocating GPU memory buffers through the driver interface
2. Triggering the deallocation of these buffers while maintaining dangling references
3. Forcing reallocation of the freed memory region with attacker-controlled content
4. Triggering access to the dangling reference, causing the driver to operate on attacker-controlled data

This can potentially lead to arbitrary kernel code execution or privilege escalation, given the kernel-level context of the GPU driver operations.

Detection Methods for CVE-2025-0072

Indicators of Compromise

• Unexpected GPU driver crashes or kernel panics related to memory corruption
• Anomalous memory access patterns in GPU driver logs or kernel debugging output
• Unusual privilege escalation attempts from unprivileged processes interacting with GPU interfaces
• Abnormal GPU memory allocation and deallocation sequences detected in system traces

Detection Strategies

• Monitor kernel logs for GPU driver error messages indicating memory corruption or invalid memory access
• Implement kernel-level memory debugging tools (KASAN) to detect use-after-free conditions in development and testing environments
• Deploy endpoint detection solutions capable of monitoring GPU driver interactions and flagging suspicious memory operation patterns
• Use behavioral analysis to identify processes performing unusual sequences of GPU memory operations

Monitoring Recommendations

• Enable verbose logging for GPU kernel driver operations on critical systems
• Implement real-time kernel crash monitoring with alerting for GPU-related exceptions
• Monitor for unexpected privilege escalation events following GPU driver interactions
• Deploy SentinelOne Singularity platform for comprehensive endpoint visibility and detection of kernel-level exploitation attempts

How to Mitigate CVE-2025-0072

Immediate Actions Required

• Identify all systems running vulnerable Arm Valhall or 5th Gen GPU kernel driver versions
• Apply the latest kernel driver updates from Arm or your device manufacturer immediately
• Restrict local system access to trusted users only until patches can be applied
• Monitor affected systems for signs of exploitation attempts

Patch Information

Arm has released updated versions of the affected kernel drivers. Organizations should update to driver versions beyond r53p0 for both Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. For detailed patch information and download links, refer to the ARM Developer Documentation.

For mobile devices and embedded systems, patches will typically be distributed through vendor-specific update channels. Android device users should ensure they have the latest security patches from their device manufacturer.

Workarounds

• Limit local access to affected systems to trusted administrators only
• Implement strict application sandboxing to restrict GPU driver access from untrusted applications
• Monitor and restrict GPU memory allocation APIs using system call filtering where possible
• Consider disabling non-essential GPU functionality on critical systems until patches are applied

# Check current GPU driver version on Linux systems
cat /sys/module/mali*/version 2>/dev/null || echo "Mali driver version not available"

# Monitor kernel logs for GPU-related errors
dmesg | grep -i "mali\|gpu\|memory"

# Enable kernel memory debugging (development systems only)
# echo 1 > /sys/kernel/debug/kasan/report_once