CVE-2025-0015

High

Published: 03 February 2025

Published

03 February 2025

Modified

18 December 2025

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0013 32.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0015 is a high-severity Use After Free (CWE-416) vulnerability in Arm 5Th Gen Gpu Architecture Kernel Driver. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the Use After Free flaw in the affected Arm GPU kernel driver versions by applying vendor-provided patches.

SI-16 Memory Protection good match

prevent

Implements memory protections like DEP and ASLR to prevent unauthorized code execution and data access from the Use After Free vulnerability.

SI-10 Information Input Validation partial match

prevent

Validates malicious GPU workloads submitted by local non-privileged processes to block improper operations that trigger the Use After Free.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local kernel driver use-after-free enables direct exploitation for privilege escalation from low-privileged user to kernel code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue…

affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0.

Deeper analysisAI

CVE-2025-0015 is a Use After Free vulnerability (CWE-416) in the Arm Ltd Valhall GPU Kernel Driver and Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver. It enables a local non-privileged user process to perform improper GPU processing operations, resulting in access to already freed memory. The issue affects Valhall GPU Kernel Driver versions from r48p0 through r49p1 and from r50p0 through r52p0, as well as Arm 5th Gen GPU Architecture Kernel Driver versions from r48p0 through r49p1 and from r50p0 through r52p0. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-03.

A local attacker with low privileges (PR:L) can exploit this vulnerability without user interaction (UI:N) by submitting malicious GPU workloads through a non-privileged user process. Successful exploitation grants access to freed kernel memory, potentially allowing arbitrary code execution, data corruption, or system crashes with high impacts on confidentiality, integrity, and availability in the local attack vector (AV:L).

Mitigation details are available in the Arm Security Center advisory on Mali GPU Driver Vulnerabilities at https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities.