CVE-2025-8045: Arm 5th Gen GPU Driver Use After Free Flaw

CVE-2025-8045 Overview

CVE-2025-8045 is a Use After Free vulnerability affecting Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. This memory corruption flaw allows a local non-privileged user process to perform improper GPU processing operations, gaining access to already freed memory regions. The vulnerability has been classified as Medium severity with a CVSS score of 4.0.

Critical Impact

Local attackers can exploit improper GPU memory management to access freed memory, potentially leading to information disclosure on affected Arm GPU systems.

Affected Products

• Arm Valhall GPU Kernel Driver versions r53p0 through r54p1
• Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r54p1

Discovery Timeline

• 2025-12-01 - CVE-2025-8045 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-8045

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a critical class of memory corruption vulnerabilities. The flaw exists in Arm's GPU kernel drivers where memory that has been freed can subsequently be accessed through improper GPU processing operations.

The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates:

• Attack Vector: Local access required
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The EPSS (Exploit Prediction Scoring System) data shows a probability of 0.016% with a percentile of 2.563, indicating a relatively low likelihood of exploitation in the wild.

Root Cause

The root cause of CVE-2025-8045 lies in improper memory lifecycle management within the Arm GPU kernel drivers. When GPU processing operations are performed, the driver fails to properly validate that memory references point to valid, allocated memory regions. This allows a local process to craft GPU operations that reference memory after it has been freed, creating a classic Use After Free condition.

In GPU kernel drivers, memory management is particularly complex due to the shared nature of GPU and CPU memory spaces. The vulnerability occurs when the driver does not adequately track the state of memory allocations during GPU processing operations, allowing stale pointers to be dereferenced.

Attack Vector

The attack vector for CVE-2025-8045 requires local access to the system. An attacker with local, non-privileged access can exploit this vulnerability by:

1. Allocating GPU memory through the kernel driver interface
2. Triggering the deallocation of that memory
3. Initiating GPU processing operations that reference the freed memory region
4. Reading the contents of the freed memory, potentially exposing sensitive data

The vulnerability mechanism centers on the GPU driver's failure to properly invalidate memory references when buffers are freed. When an attacker triggers GPU operations after memory deallocation, the driver may still attempt to access the freed memory region, potentially exposing data from subsequent allocations or residual data from previous operations.

Detection Methods for CVE-2025-8045

Indicators of Compromise

• Unusual GPU driver activity from non-privileged processes
• Abnormal memory allocation patterns in GPU-related kernel modules
• Unexpected memory access patterns in Valhall or 5th Gen GPU kernel driver operations

Detection Strategies

Organizations should implement the following detection strategies to identify potential exploitation attempts:

1. Kernel Auditing: Enable kernel auditing for GPU driver interactions, monitoring for unusual patterns of memory allocation and deallocation sequences
2. Driver Version Monitoring: Implement automated scanning to identify systems running vulnerable driver versions (r53p0 through r54p1)
3. Behavioral Analysis: Monitor for processes attempting repeated GPU memory operations with suspicious timing patterns that could indicate exploitation attempts
4. SentinelOne Singularity: Deploy SentinelOne's kernel-level protection capabilities to detect anomalous memory access patterns and potential Use After Free exploitation attempts

Monitoring Recommendations

Security teams should prioritize monitoring systems with Arm GPUs, particularly mobile devices and embedded systems that commonly use Valhall or 5th Gen GPU architecture. Implement logging for GPU driver interactions and establish baselines for normal GPU memory operation patterns. Any deviation from established patterns should trigger alerts for further investigation.

How to Mitigate CVE-2025-8045

Immediate Actions Required

• Update Arm GPU kernel drivers to versions newer than r54p1
• Audit systems for vulnerable driver versions using asset management tools
• Implement application whitelisting to restrict which processes can interact with GPU drivers
• Enable enhanced logging for GPU driver operations on critical systems

Patch Information

Arm has released updated driver versions to address this vulnerability. Organizations should consult the official Arm security advisory at https://developer.arm.com/documentation/110697/latest/ for detailed patch information and updated driver downloads.

The patched versions include proper memory lifecycle validation during GPU processing operations, ensuring that freed memory regions cannot be accessed through subsequent GPU operations.

Workarounds

If immediate patching is not possible, organizations should consider the following temporary mitigations:

1. Restrict Local Access: Limit local access to systems with vulnerable GPU drivers to trusted users only
2. Application Control: Implement strict application control policies to prevent unauthorized applications from interacting with GPU drivers
3. System Hardening: Apply additional kernel hardening measures such as enabling KASLR and other memory protection mechanisms
4. Monitoring Enhancement: Increase monitoring and alerting sensitivity for GPU-related system calls and driver interactions

For systems running SentinelOne Singularity platform, ensure that kernel protection policies are enabled and configured to detect memory corruption exploitation attempts. Contact SentinelOne support for specific detection rules related to GPU driver vulnerabilities.