CVE-2025-0932: Fixes potential UAF in the ARM shader compiler reachable through WebGPU
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-0932?
CVE-2025-0932 is classified as a high severity vulnerability due to its potential to allow non-privileged user processes to exploit memory management flaws.
How do I fix CVE-2025-0932?
To mitigate CVE-2025-0932, upgrade affected drivers to the latest versions specified by Arm Ltd that patch the use-after-free vulnerability.
Which products are affected by CVE-2025-0932?
CVE-2025-0932 affects Arm Ltd's Bifrost GPU Userspace Driver, Valhall GPU Userspace Driver, and 5th Gen GPU Architecture Userspace Driver in specific version ranges.
What is a use-after-free vulnerability like CVE-2025-0932?
A use-after-free vulnerability, such as CVE-2025-0932, occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution.
Can CVE-2025-0932 be exploited remotely?
CVE-2025-0932 could be exploited remotely when attackers leverage valid GPU processing operations, particularly through WebGL or WebGPU.