CVE-2022-36449 json
An issue was discovered in the Arm Mali GPU Kernel Driver.
published 2022-09-01 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-39158
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.
Exploit prediction
1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
developer.arm.com
/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
vendor-advisory
-
packetstormsecurity.com
/files/168432/Arm-Mali-Physical-Address-Exposure.html
third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.html
third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/168434/Arm-Mali-CSF-Missing-Buffer-Size-Check.html
third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/168433/Arm-Mali-Race-Condition.html
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2022-36449
- NVD CVE-2022-36449
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.