CVE-2025-2879: Arm 5th Gen GPU Information Disclosure Flaw

CVE-2025-2879 Overview

CVE-2025-2879 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability affecting Arm Ltd's Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. This security flaw allows a local non-privileged user process to perform improper GPU processing operations that can expose sensitive data from memory.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the affected GPU drivers fail to properly protect sensitive information during GPU processing operations. This could allow attackers with local access to extract confidential data that should be protected from unauthorized access.

Critical Impact

Local attackers can leverage improper GPU processing operations to expose sensitive data without requiring elevated privileges, potentially compromising confidentiality and integrity of system data.

Affected Products

• Arm Valhall GPU Kernel Driver versions r29p0 through r49p4
• Arm Valhall GPU Kernel Driver versions r50p0 through r54p0
• Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r49p4
• Arm 5th Gen GPU Architecture Kernel Driver versions r50p0 through r54p0

Discovery Timeline

• 2025-12-01 - CVE-2025-2879 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-2879

Vulnerability Analysis

This vulnerability exists in the Arm GPU kernel drivers and stems from improper handling of GPU processing operations. With a CVSS v3.1 score of 5.1 (Medium severity) and vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, the vulnerability requires local access but does not require any privileges or user interaction to exploit.

The CVSS breakdown indicates:

• Attack Vector (AV:L): Local access required
• Attack Complexity (AC:L): Low complexity to exploit
• Privileges Required (PR:N): No privileges needed
• User Interaction (UI:N): No user interaction required
• Scope (S:U): Unchanged scope
• Confidentiality Impact (C:L): Low impact on confidentiality
• Integrity Impact (I:L): Low impact on integrity
• Availability Impact (A:N): No impact on availability

The EPSS (Exploit Prediction Scoring System) data shows a probability of 0.016% with a percentile of 2.563, indicating a relatively low likelihood of exploitation in the wild as of 2025-12-16.

Root Cause

The root cause of CVE-2025-2879 lies in improper GPU memory handling within the kernel driver. GPU drivers manage shared memory regions between the CPU and GPU, and when these operations are not properly secured, a local process can manipulate GPU processing operations to access memory regions that should be protected. This represents a failure in the isolation mechanisms that should prevent non-privileged processes from accessing sensitive data through GPU operations.

Attack Vector

The attack vector for this vulnerability involves a local, non-privileged user process exploiting improper GPU processing operations. An attacker with local access to a system running the vulnerable Arm GPU kernel drivers could craft malicious GPU operations that bypass normal memory protection mechanisms.

The exploitation flow typically involves:

1. A local attacker initiates specially crafted GPU processing operations through the vulnerable kernel driver
2. The driver fails to properly validate or isolate these operations
3. The improper handling allows the attacker to access memory contents that should be protected
4. Sensitive data from other processes or the kernel may be exposed to the attacker

Since the vulnerability affects GPU kernel drivers, devices using Arm Mali GPUs with Valhall architecture or 5th generation Arm GPU architecture are potentially at risk. This includes many Android smartphones, tablets, and embedded systems.

Detection Methods for CVE-2025-2879

Indicators of Compromise

• Unusual GPU driver activity from non-graphics processes
• Unexpected memory access patterns in GPU operations
• Anomalous process behavior accessing GPU interfaces without legitimate graphics workload
• Increased GPU driver system calls from suspicious processes

Detection Strategies

Organizations should implement monitoring for abnormal GPU driver interactions, particularly from processes that would not typically perform GPU operations. Security teams can leverage endpoint detection and response (EDR) solutions to monitor for:

• Processes loading or interacting with GPU kernel drivers unexpectedly
• Memory access patterns indicative of information disclosure attempts
• System calls to GPU driver interfaces from non-trusted applications

SentinelOne's Singularity platform provides behavioral AI detection capabilities that can identify anomalous process behavior, including unusual GPU driver interactions that may indicate exploitation attempts.

Monitoring Recommendations

1. Enable detailed logging for GPU driver operations where available
2. Monitor for processes attempting to access GPU resources without legitimate use cases
3. Implement application allowlisting to control which processes can interact with GPU drivers
4. Deploy endpoint protection solutions capable of detecting memory disclosure attack patterns
5. Regularly audit systems for the presence of vulnerable driver versions

How to Mitigate CVE-2025-2879

Immediate Actions Required

• Identify all systems running affected Arm GPU kernel driver versions (r29p0 through r54p0)
• Review Arm's security advisory at the vendor documentation link for patch availability
• Apply driver updates from device manufacturers as they become available
• Restrict local access to systems where possible until patches are applied
• Monitor affected systems for suspicious GPU-related activity

Patch Information

Arm has published a security advisory addressing this vulnerability. Organizations should consult the official Arm documentation at https://developer.arm.com/documentation/110697/latest/ for detailed patch information and updated driver versions.

For mobile devices and embedded systems, patches will typically be delivered through:

• Device manufacturer firmware updates
• Android security patches for affected Android devices
• Linux kernel driver updates for systems using Arm Mali GPUs

Workarounds

While awaiting patches, organizations can implement the following mitigations:

1. Restrict Local Access: Limit local user access to affected systems to trusted users only
2. Application Control: Implement application allowlisting to prevent unauthorized processes from interacting with GPU drivers
3. Enhanced Monitoring: Deploy enhanced monitoring for GPU driver activity and suspicious memory access patterns
4. Process Isolation: Where possible, use containerization or sandboxing to isolate sensitive workloads from potentially malicious local processes

For systems where immediate patching is not possible, security teams should prioritize monitoring and access control measures while working with device manufacturers to obtain updated drivers.