CVE-2022-38181

An Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to...

8.8 HighIn KEVPublic exploitFix available

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

18.5%Up 17.6 points since Oct 26, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2022-38181
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List 8.8

Record: CVE-2022-38181
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2022-40775 8.8

Record: EUVD-2022-40775
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h73c-qgg5-q5rp 8.8

An Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to...

An Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to make improper GPU processing operations to gain access to already freed memory.

Record: GHSA-h73c-qgg5-q5rp
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CISA KEV No score

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

Record: CVE-2022-38181
Weakness: CWE-416
Updated: 2026-11-02

OSVASB-A-259695958 No score

In kbase_mem_flags_change of mali_kbase_mem_linux.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Record: ASB-A-259695958
Updated: 2026-11-05

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`:unknown:` Android	SoCVersion:0 up to SoCVersion:2023-04-05, plus listed versions SoCVersion	SoCVersion:2023-04-05

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Pro-me3us/CVE_2022_38181_Gazelle	2023-04-13
PoC in GitHub	Pro-me3us/CVE_2022_38181_Raven	2023-04-13
PoC in GitHub	R0rt1z2/CVE-2022-38181	2023-05-12
PoC in GitHub	soralis0912/CVE-2022-38181-aristotle	2026-07-25
PoC in GitHub	ericpardee/fire-hd-ownership	2026-08-20
PoC in GitHub	artur9010/amazon-mustang-hack	2026-09-11
PoC in GitHub	s1204IT/CVE-2022-38181	2026-10-29
PoC in GitHub	lRENyaaa/AGM3-W09HN-TMP-ROOT-CVE-2022-38181	2026-11-05

History

History
Recorded	Changed	Sources
Nov 6, 2026	exploits	OSV, PoC in GitHub
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-38181 is a high vulnerability (CVSS 8.8) in Arm Bifrost Gpu Kernel Driver, published October 25, 2022. CISA lists it as known to be exploited, since March 30, 2023. EUVD reports exploitation since March 30, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.5%, the 97th percentile. Fixed in :unknown: SoCVersion:2023-04-05.