Loading vulnerability…
CVE-2025-8045 is a use-after-free vulnerability in Arm Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. A local non-privileged user process can trigger improper GPU processing operations that result in access to memory that has already been freed. The issue affects driver releases from r53p0 through r54p1. Because the flaw is in the kernel GPU driver, exploitation crosses the boundary between an unprivileged local process and privileged kernel-managed GPU memory handling, creating a path to unauthorized memory access and potentially broader compromise of graphics isolation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single real local privilege escalation exploit in C (`exploit.c`) plus a README describing the bug and usage. It targets CVE-2025-8045, a use-after-free in the Arm Mali GPU kernel driver KCPU queue dump path, reachable by an unprivileged local process through the CSF interface on `/dev/mali0`. Repository structure is minimal: `README.md` documents the vulnerability, exploitation stages, build/run instructions, affected versions, and portability caveats; `exploit.c` implements the full exploit chain. The code defines Mali driver ioctl structures/constants, queue command types, timing parameters, heap grooming constants, page-table spray settings, and hardcoded kernel offsets for the tested target. Core exploit capability: it creates a KCPU queue, enqueues an unsatisfiable `CQS_WAIT` followed by `FENCE_SIGNAL`, then repeatedly races `KBASE_IOCTL_CS_CPU_QUEUE_DUMP` against the queue state transition to free `cpu_queue.buffer` while still referenced. The exploit calibrates timer-wheel phase on an initial round, predicts future deadlines, and uses a 64-thread 'wave' of dump calls to widen the race window. After winning the race, it attempts deterministic reclaim of the freed object using GPU memory sprays and then CPU page-table sprays, turning the dangling allocation into a writable alias of a live CPU page table ('dirty pagetable'). With that primitive, the exploit rewrites a chosen PTE to map arbitrary kernel physical pages, flushes TLB state, and performs kernel physical read/write. It then disables SELinux enforcement by modifying `selinux_state.enforcing` and patches `sel_read_enforce` to effectively invoke `commit_creds(init_cred)`, resulting in root privileges and a root shell. The README notes the process intentionally parks forever after success because the aliased page is simultaneously treated as a Mali allocation and a live CPU page table, so freeing it would likely panic the kernel. There are no network callbacks or remote endpoints; this is strictly a local attack vector. The most fingerprintable artifacts are the device node `/dev/mali0`, the Mali ioctl names, and the hardcoded kernel offsets/constants specific to Pixel 7 Pro build `BP3A.250905.014`. Overall, this is an operational, target-specific Android kernel LPE exploit rather than a detector or generic proof-of-concept.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
High-severity vulnerability affecting Arm Mali GPU components (GPU driver class issues such as memory corruption/information disclosure/local privilege escalation are mentioned generally).
High-severity ARM Mali GPU driver vulnerability fixed via vendor updates; could undermine graphics isolation and be chained with other issues.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.