What is CVE-2022-38181?

CVE-2022-38181 is a high-severity vulnerability in Arm Bifrost GPU Kernel Driver, classified under Use After Free. CVSS score: 8.8/10. Published 2022-10-25.

How severe is CVE-2022-38181?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2022-38181 known to be exploited?

Yes. CVE-2022-38181 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-03-30), indicating it is being actively exploited. 18 public proof-of-concept repositories are indexed.

Use After Free in Arm Bifrost GPU Kernel Driver

CVE-2022-38181

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.

Vulnerability class: Use-After-Free

Published 2022-10-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.141 (96.5th percentile), scored 2026-10-19.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.136 · newest: 0.141 · change: +0.005

Affected products

Arm Bifrost GPU Kernel Driver — versions r39p0
Arm Midgard GPU Kernel Driver
Arm Valhall GPU Kernel Driver — versions r39p0

Weakness classification (CWE)

CWE-416 — Use After Free

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2023-03-30. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2023-04-20.

Required action: Apply updates per vendor instructions.

Public proof-of-concept exploits

References

developer.arm.com/support/arm-security-updates (Vendor Advisory)
developer.arm.com/Arm Security Center/Mali GPU Driver Vulnerabilities (Vendor Advisory)
github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/ (Exploit, Third Party Advisory)
securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/ (Exploit, Third Party Advisory)
packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execut… (VDB Entry, Third Party Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2022-38181?: CVE-2022-38181 is a high-severity vulnerability in Arm Bifrost GPU Kernel Driver, classified under Use After Free. CVSS score: 8.8/10. Published 2022-10-25.
How severe is CVE-2022-38181?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2022-38181 known to be exploited?: Yes. CVE-2022-38181 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-03-30), indicating it is being actively exploited. 18 public proof-of-concept repositories are indexed.