What is the CVSS score of CVE-2025-0073?

CVE-2025-0073 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 5th Gen Gpu Architecture Kernel Driver are affected by CVE-2025-0073?

A use-after-free vulnerability in Arm GPU kernel drivers (Valhall and 5th Gen architectures) allows local attackers to access freed memory, potentially leading to unauthorized data access or system…

How to fix or mitigate CVE-2025-0073?

Within 24 hours: Identify and inventory all systems using Valhall GPU Kernel Driver (r53p0-r53p99) or Arm 5th Gen GPU Architecture Kernel Driver (r53p0-r53p99); assess exposure in production environments. Within 7 days: Evaluate the availability of r54p0 patches from your hardware OEM/vendor and develop a deployment timeline; implement compensating controls on critical systems. Within 30 days: Apply vendor patches to all affected systems in a phased rollout; validate remediation and document completion.

5th Gen Gpu Architecture Kernel Driver CVE-2025-0073

EUVD-2025-16639 HIGH

Use After Free (CWE-416)

2025-06-02 arm-security@arm.com

Use After Free Memory Corruption Privilege Escalation 5th Gen Gpu Architecture Kernel Driver Valhall Gpu Kernel Driver

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16639

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 11:15 nvd

HIGH 7.8

DescriptionCVE.org

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 before r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0.

AnalysisAI

Use After Free (UAF) vulnerability in Arm Ltd's Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver that allows a local, unprivileged user to access already-freed GPU memory through improper GPU memory processing operations. Affected versions range from r53p0 before r54p0 in both driver families. With a CVSS score of 7.8 and high impact across confidentiality, integrity, and availability, this vulnerability enables memory disclosure, data manipulation, and potential denial of service on systems running vulnerable GPU drivers.

Technical ContextAI

This vulnerability exists in the GPU kernel driver layer responsible for managing GPU memory operations and allocation/deallocation routines. The root cause is classified as CWE-416 (Use After Free), a memory safety issue where freed GPU memory objects are accessed after their deallocation without proper reference counting or state validation. In GPU drivers, this typically occurs when: (1) GPU memory is deallocated but pointers remain in driver structures, (2) GPU command streams reference memory without validity checks, or (3) asynchronous GPU operations complete after memory is freed. The affected components are the Valhall GPU Kernel Driver (r53p0-r53pX) and Arm 5th Gen GPU Architecture Kernel Driver (r53p0-r53pX), both critical components in Mali GPU stacks used in mobile SoCs. The vulnerability affects the GPU memory management subsystem responsible for handling user-space memory allocation requests through ioctl interfaces.