Valhall Gpu Kernel Driver CVE-2025-0073

This vulnerability presents significant real-world risk across multiple dimensions: (1) CVSS 7.8 (High) with Low attack complexity and Low privilege requirements confirms practical exploitability—any unprivileged local process can trigger the vulnerability without special conditions; (2) Attack vector is Local (AV:L), meaning the attacker must have local access, typical for mobile device compromise or multi-tenant cloud GPU scenarios; (3) The impact assessment (C:H/I:H/A:H) indicates complete compromise of GPU memory confidentiality, integrity, and availability—critical for systems relying on GPU for security-sensitive operations (cryptography, DRM); (4) As a kernel-mode driver vulnerability affecting millions of Mali GPU-equipped devices (Samsung, MediaTek, Qualcomm SoCs), the blast radius is substantial. The use-after-free nature makes exploitation highly reliable—attackers can deterministically trigger memory access violations. Without disclosed EPSS or KEV status indicators in the provided data, we assess this as HIGH PRIORITY based on: local attack vector + unprivileged access + high impact + widespread GPU driver deployment. This is NOT a low-real-risk issue despite being local-only; GPU drivers are common attack targets post-device compromise.

An attacker with local user access (e.g., unprivileged app on Android, container user in cloud GPU environment) performs the following exploitation steps: (1) Opens a GPU context via the Mali GPU driver ioctl interface (typically /dev/mali0); (2) Allocates GPU memory buffers and obtains handle references; (3) Crafts a sequence of GPU commands that deallocate GPU memory while maintaining handle references; (4) Issues subsequent GPU commands that reference the freed memory, triggering the use-after-free condition; (5) Observes GPU memory contents from already-freed allocations, reading sensitive data (cryptographic keys, DRM content), or overwrites freed memory to corrupt GPU state or kernel structures; (6) Escalates to kernel code execution if GPU memory can be overlapped with kernel memory regions, or achieves denial of service by crashing the GPU driver. Low attack complexity (AC:L) means standard exploitation tools and well-known UAF techniques suffice—no zero-day exploit development required. The lack of user interaction (UI:N) and non-compartmentalized GPU memory access (S:U) make this highly exploitable in practice.