EUVD-2025-16639

This vulnerability exists in the GPU kernel driver layer responsible for managing GPU memory operations and allocation/deallocation routines. The root cause is classified as CWE-416 (Use After Free), a memory safety issue where freed GPU memory objects are accessed after their deallocation without proper reference counting or state validation. In GPU drivers, this typically occurs when: (1) GPU memory is deallocated but pointers remain in driver structures, (2) GPU command streams reference memory without validity checks, or (3) asynchronous GPU operations complete after memory is freed. The affected components are the Valhall GPU Kernel Driver (r53p0-r53pX) and Arm 5th Gen GPU Architecture Kernel Driver (r53p0-r53pX), both critical components in Mali GPU stacks used in mobile SoCs. The vulnerability affects the GPU memory management subsystem responsible for handling user-space memory allocation requests through ioctl interfaces.