CVE-2022-38181: Arm Mali GPU kernel driver use-after-free via mishandled GPU memory operations

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with public exploit references and high CVSS impact, but exploitation requires local low-privileged access rather than being remotely reachable without prerequisites.

What it is

The Arm Mali GPU kernel driver mishandles GPU memory operations, allowing unprivileged users to access freed memory (CWE-416 use-after-free). It affects Bifrost r0p0 through r38p1 and r39p0, Valhall r19p0 through r38p1 and r39p0, and Midgard r4p0 through r32p0. Because the flaw is reachable by unprivileged local users and yields high confidentiality, integrity and availability impact, it is a serious privilege-escalation and sandbox-escape primitive on affected devices.

Impact

An attacker gains access to freed GPU memory, which can lead to memory corruption and arbitrary code execution in the kernel context. Public references describe Android arbitrary code execution, so the practical gain is kernel-level code execution and potential full device compromise.

Attack surface

The CVSS vector is network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), but the description states the driver allows unprivileged users to access freed memory, indicating a local attack surface on the device. Reaching the flaw requires the ability to issue GPU memory operations, i.e. code already running on the target with low privileges; no user interaction is needed.

Exploitation

CVE-2022-38181 is listed in CISA KEV (added 2023-03-30, due 2023-04-20) and has an EPSS 30-day probability of 0.13556 (96.3rd percentile). Multiple references are tagged Exploit, including GitHub Security Lab and GitHub blog write-ups, so public exploit material exists; KEV records no known ransomware campaign use.

What to do

• Apply the vendor updates listed in Arm's Mali GPU Driver Vulnerabilities and Arm Security Updates advisories for the affected Bifrost, Valhall and Midgard driver versions.
• For Android devices, install the OEM/Google security patch level that includes the Mali driver fix; verify the patch level rather than assuming it.
• Where patching is not immediately possible, restrict or remove untrusted applications that can issue GPU memory operations, and reduce the number of low-privileged local users on affected devices.
• Track affected device fleets by GPU driver version (Bifrost, Valhall, Midgard) and prioritize internet-exposed or multi-tenant devices.
• Monitor vendor advisories for updated fixed driver revisions, since the affected range spans many rXpY releases.

Detection

• Inventory devices and firmware reporting Mali Bifrost, Valhall or Midgard GPU kernel driver versions in the affected ranges.
• Monitor for kernel crashes, GPU driver faults and use-after-free style memory corruption reports in device logs on affected hardware.
• Hunt for unexpected privilege escalation or code execution originating from processes interacting with the GPU driver, especially on Android devices.
• Correlate endpoint telemetry with known exploit artifacts from the public GitHub Security Lab and GitHub blog write-ups for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.