CVE-2025-0073: Arm GPU Kernel Driver Use-After-Free Flaw

CVE-2025-0073 Overview

CVE-2025-0073 is a use-after-free vulnerability [CWE-416] in the Arm Valhall GPU Kernel Driver and the Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can perform improper GPU memory processing operations to access memory that has already been freed. The flaw affects driver versions from r53p0 before r54p0 in both driver families. Successful exploitation impacts confidentiality, integrity, and availability of the affected system. Because Arm Mali GPU drivers ship inside many Android devices and embedded Linux platforms, the vulnerability has broad downstream reach across the mobile and IoT ecosystem.

Critical Impact
A local unprivileged process can access freed GPU kernel memory, enabling potential privilege escalation on affected Android and Linux devices.

Affected Products

Arm Valhall GPU Kernel Driver: from r53p0 before r54p0
Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0
Downstream Android and Linux devices that ship these Mali GPU kernel drivers

Discovery Timeline

2025-06-02 - CVE-2025-0073 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0073

Vulnerability Analysis

The issue is a use-after-free condition [CWE-416] inside the Arm Mali GPU kernel driver. GPU memory processing routines release a kernel object while another code path still holds and dereferences a reference to it. A local process invoking the driver through standard GPU ioctl interfaces can trigger reuse of the freed allocation. Because the driver executes in kernel context, controlled reuse of freed memory can be steered toward code execution or data tampering in the kernel.

The vulnerability requires only local access with low privileges and no user interaction. Attack complexity is low, which makes it a practical target for chain-based exploitation from a sandboxed Android application or an unprivileged Linux user account. Mali GPU driver bugs have historically been used as second-stage primitives in Android browser and sandbox escapes.

Root Cause

The root cause is improper lifetime management of a GPU memory object inside the Valhall and 5th Gen GPU Architecture kernel drivers. A reference to the object outlives the free operation, so subsequent operations on that pointer touch memory that the kernel allocator may have reissued to attacker-controlled content.

Attack Vector

Exploitation is local. A non-privileged user process opens the Mali GPU device node and issues crafted GPU memory processing operations that race or sequence a free with a later use. No verified public proof-of-concept is available at this time.

No verified exploit code is available. See the Arm advisory referenced below for
technical details on the affected memory processing paths and the r54p0 fix.

Detection Methods for CVE-2025-0073

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN: use-after-free reports referencing Mali GPU driver symbols in dmesg or logcat.
Unprivileged processes repeatedly opening /dev/mali0 and issuing high volumes of GPU memory allocation and free ioctls.
Crashes or privilege transitions in processes that previously interacted with the Mali GPU device node.

Detection Strategies

Inventory Android and Linux devices to identify Mali GPU kernel driver versions in the r53p0 range and flag any not upgraded to r54p0 or later.
Enable kernel address sanitizer or equivalent runtime memory checkers on test devices to surface use-after-free conditions in Mali driver paths.
Correlate kernel crash telemetry with process context to identify unprivileged callers triggering GPU driver faults.

Monitoring Recommendations

Forward kernel logs and Android logcat kernel messages to a central log store and alert on Mali GPU stack traces.
Track process behavior on endpoints for unprivileged binaries that open GPU device nodes and issue anomalous ioctl sequences.
Monitor for successful privilege escalations following GPU driver interaction, which can indicate exploit success.

How to Mitigate CVE-2025-0073

Immediate Actions Required

Upgrade the Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver to r54p0 or later.
Coordinate with device OEMs and SoC vendors to obtain updated Android or Linux firmware images that include the fixed driver.
Prioritize patching of multi-tenant, kiosk, and shared-use devices where local unprivileged access is available to more actors.

Patch Information

Arm has published fixes in driver release r54p0. Refer to the Arm Mali GPU Kernel Driver Vulnerabilities advisory for the authoritative fixed-version matrix and downstream integration guidance.

Workarounds

No official workaround is provided by Arm; the vendor guidance is to upgrade to r54p0 or later.
Where patching is delayed, restrict installation of untrusted applications on affected Android devices to reduce local attacker exposure.
On Linux systems, limit which user accounts can access the Mali GPU device node via filesystem permissions or mandatory access control policies.

bash

# Verify installed Mali GPU kernel driver version on Linux
cat /sys/module/mali_kbase/version 2>/dev/null || \
  dmesg | grep -i "mali"

# Restrict access to the Mali device node to a trusted group as a stopgap
chgrp video /dev/mali0
chmod 660 /dev/mali0