{"id":"CVE-2022-38181","aliases":["A-259695958","ASB-A-259695958","EUVD-2022-40775","GHSA-h73c-qgg5-q5rp"],"status":"published","title":"An Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to...","description":"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.18461,"percentile":0.97262,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2022-10-25T00:00:00Z","modified":"2026-11-05T16:32:28Z","kev":{"date_added":"2023-03-30","due_date":"2023-04-20","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-03-30"},{"source":"kev","since":"2023-03-30"}],"exploits":[{"source":"pocgithub","id":"Pro-me3us/CVE_2022_38181_Gazelle","title":"Pro-me3us/CVE_2022_38181_Gazelle","date":"2023-04-13","url":"https://github.com/Pro-me3us/CVE_2022_38181_Gazelle"},{"source":"pocgithub","id":"Pro-me3us/CVE_2022_38181_Raven","title":"Pro-me3us/CVE_2022_38181_Raven","date":"2023-04-13","url":"https://github.com/Pro-me3us/CVE_2022_38181_Raven"},{"source":"pocgithub","id":"R0rt1z2/CVE-2022-38181","title":"R0rt1z2/CVE-2022-38181","date":"2023-05-12","url":"https://github.com/R0rt1z2/CVE-2022-38181"},{"source":"pocgithub","id":"soralis0912/CVE-2022-38181-aristotle","title":"soralis0912/CVE-2022-38181-aristotle","date":"2026-07-25","url":"https://github.com/soralis0912/CVE-2022-38181-aristotle"},{"source":"pocgithub","id":"ericpardee/fire-hd-ownership","title":"ericpardee/fire-hd-ownership","date":"2026-08-20","url":"https://github.com/ericpardee/fire-hd-ownership"},{"source":"pocgithub","id":"artur9010/amazon-mustang-hack","title":"artur9010/amazon-mustang-hack","date":"2026-09-11","url":"https://github.com/artur9010/amazon-mustang-hack"},{"source":"pocgithub","id":"s1204IT/CVE-2022-38181","title":"s1204IT/CVE-2022-38181","date":"2026-10-29","url":"https://github.com/s1204IT/CVE-2022-38181"},{"source":"pocgithub","id":"lRENyaaa/AGM3-W09HN-TMP-ROOT-CVE-2022-38181","title":"lRENyaaa/AGM3-W09HN-TMP-ROOT-CVE-2022-38181","date":"2026-11-05","url":"https://github.com/lRENyaaa/AGM3-W09HN-TMP-ROOT-CVE-2022-38181"}],"fixes":[{"ecosystem":"Android","package":":unknown:","fixed_in":["SoCVersion:2023-04-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2023-04-05"}]}],"versions":["SoCVersion"]}],"products":[{"vendor":"arm","product":"bifrost_gpu_kernel_driver"},{"vendor":"arm","product":"mali graphics processing unit (gpu)"},{"vendor":"arm","product":"midgard_gpu_kernel_driver"},{"vendor":"arm","product":"valhall_gpu_kernel_driver"}],"references":[{"url":"https://developer.arm.com/support/arm-security-updates","tags":["x_transferred","Vendor Advisory"]},{"url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","tags":["x_transferred","Vendor Advisory"]},{"url":"https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38181","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38181"},{"url":"https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug"},{"url":"https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali"},{"url":"https://github.com/advisories/GHSA-h73c-qgg5-q5rp"},{"url":"https://source.android.com/security/bulletin/2023-04-01","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-38181","description":"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-10-21T23:15:32.846Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:37.272373Z"}],"euvd":[{"id":"EUVD-2022-40775","description":"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-10-21T23:15:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2023-03-30","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-h73c-qgg5-q5rp","title":"An Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to...","description":"An Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to make improper GPU processing operations to gain access to already freed memory.","status":"published","published":"2022-10-26T12:00:39Z","modified":"2025-10-22T00:32:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2022-38181","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","description":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.","cwes":["CWE-416"],"kev":{"date_added":"2023-03-30","due_date":"2023-04-20","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-38181","description":"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.","status":"published","published":"2022-10-25T19:15:11.487Z","modified":"2026-06-17T04:56:14.803Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"ASB-A-259695958","description":"In kbase_mem_flags_change of mali_kbase_mem_linux.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2023-04-01T00:00:00Z","modified":"2026-11-05T16:32:28.703711716Z","updated_at":"2026-11-05T17:55:15.258551Z"}]}}