CVE-2025-0015

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Arm Ltd	Valhall GPU Kernel Driver	>= r48p0, <= r49p1; >= r50p0, <= r52p0
Arm Ltd	Arm 5th Gen GPU Architecture Kernel Driver	>= r48p0, <= r49p1; >= r50p0, <= r52p0

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory

Timeline

Published: Feb 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-00275.9Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table CVE-2025-00288.3An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address CVE-2025-00291.8Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA write CVE-2025-00314.6A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a diffe CVE-2025-00327.2Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microco CVE-2025-00336.0Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potential CVE-2025-00344.7Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cau CVE-2025-00357.3Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbi CVE-2025-00363.2In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause d CVE-2025-00376.6In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow ac CVE-2025-00386.6In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow acces CVE-2025-00405.3Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with phys