CVE-2025-0427: Arm 5th Gen GPU Driver Use-After-Free Flaw

CVE-2025-0427 Overview

CVE-2025-0427 is a Use After Free vulnerability [CWE-416] affecting the Arm Bifrost, Valhall, and Arm 5th Gen GPU Architecture Kernel Drivers. A local, non-privileged user process can perform valid GPU processing operations to gain access to already freed memory. Exploitation can lead to kernel memory corruption, information disclosure, and potential privilege escalation on affected Android devices and Linux systems using these Arm Mali GPU drivers. The vulnerability was published to the National Vulnerability Database (NVD) on May 2, 2025, by Arm Ltd.

Critical Impact
A local non-privileged user can trigger use-after-free conditions in the Arm Mali GPU kernel driver, potentially leading to kernel-level privilege escalation with high confidentiality, integrity, and availability impact.

Affected Products

Arm Bifrost GPU Kernel Driver: r8p0 through r49p3, and r50p0 through r51p0
Arm Valhall GPU Kernel Driver: r19p0 through r49p3, and r50p0 through r53p0
Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r49p3, and r50p0 through r53p0

Discovery Timeline

2025-05-02 - CVE-2025-0427 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0427

Vulnerability Analysis

The vulnerability is a classic use-after-free (UAF) condition in the Arm Mali GPU kernel driver. GPU kernel drivers manage complex object lifecycles across user space and kernel space, including memory buffers, command streams, and job descriptors. When a local process issues valid GPU processing operations in a specific sequence, the driver frees a kernel object while retaining a reference that can subsequently be dereferenced.

An attacker who reclaims the freed allocation with attacker-controlled data can influence subsequent driver operations. On Android and Linux systems, this class of GPU driver flaw has historically been leveraged to escape application sandboxes and achieve kernel read/write primitives. The result is high impact to confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is improper object lifetime management in the Bifrost, Valhall, and 5th Gen GPU kernel drivers. A GPU processing path releases a kernel allocation without invalidating all outstanding references, leaving a dangling pointer accessible through subsequent valid GPU operations. This aligns with the CWE-416 classification.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker executes a non-privileged user process that opens the Mali GPU device node (commonly /dev/mali0 on Android and Linux) and issues a crafted sequence of ioctl-based GPU processing calls. Because most Android applications have access to the GPU device by design, the attack surface extends to any installed application on affected devices.

No public proof-of-concept has been published, and CISA has not added CVE-2025-0427 to the Known Exploited Vulnerabilities catalog. Refer to the Arm Mali GPU Driver Vulnerabilities advisory for the vendor's technical description.

Detection Methods for CVE-2025-0427

Indicators of Compromise

Unexpected process crashes, kernel oops messages, or GPU driver faults referencing mali or kbase in dmesg and logcat output.
Non-privileged processes issuing unusual volumes of ioctl calls against /dev/mali0 outside expected graphics workloads.
Sudden privilege changes for processes that previously interacted with the GPU device node.

Detection Strategies

Inventory endpoints and mobile devices to identify Bifrost, Valhall, and 5th Gen Mali GPU driver versions within the affected ranges.
Monitor kernel logs for repeated GPU faults, KASAN reports, or slab-use-after-free warnings tied to the Mali driver.
Correlate GPU driver events with process behavior analytics to flag local privilege escalation attempts originating from unprivileged user contexts.

Monitoring Recommendations

Forward kernel and Android system logs to a centralized logging platform for retention and query.
Alert on child process creation with elevated privileges from processes that recently opened /dev/mali0.
Track driver version compliance across the fleet and alert on devices running vulnerable Mali driver builds.

How to Mitigate CVE-2025-0427

Immediate Actions Required

Identify all systems and devices running affected Bifrost, Valhall, or 5th Gen GPU kernel driver revisions and prioritize them for update.
Apply the fixed Mali GPU kernel driver revisions provided by Arm and downstream SoC/OEM vendors as soon as they are available for the target platform.
On Android, install the latest available monthly security patch level from the device OEM, which incorporates Arm's fix.

Patch Information

Arm has published fixed driver revisions and technical details in the Arm Mali GPU Driver Vulnerabilities advisory. Because Mali GPU drivers are distributed through SoC vendors and device OEMs, end users must obtain patched builds through the appropriate Android or Linux vendor channel. Confirm the driver revision after patching to ensure it is outside the vulnerable ranges (r8p0–r49p3, r50p0–r51p0 for Bifrost; r19p0–r49p3, r50p0–r53p0 for Valhall; and r41p0–r49p3, r50p0–r53p0 for 5th Gen).

Workarounds

Restrict installation of untrusted applications on affected mobile devices until patches are applied.
On multi-user Linux systems, limit local access to trusted accounts and audit permissions on /dev/mali0.
Enforce application allow-listing and mobile device management (MDM) policies to reduce the risk of local exploitation.

bash

# Check the loaded Mali GPU kernel driver version on Linux/Android
adb shell dmesg | grep -i mali
cat /sys/module/mali_kbase/version 2>/dev/null
uname -r