CVE-2022-41757

highpriority · track · 35EPSS 0.008 · 55 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.76% (55th) EPSS

CVSS 8.8 · high

Is it mine?

7 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-only memory, or obtain access to already freed memory. This affects Valhall r29p0 through r38p1 before r38p2, and r39p0 before r40p0.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-123US

affected products (7)

Products and version ranges known to be affected.

Google Android 11all versionscert_bundDEcpe:/o:google:android:11
Google Android 12all versionscert_bundDEcpe:/o:google:android:12
Google Android 12Lall versionscert_bundDEcpe:/o:google:android:12l
Google Android 13all versionscert_bundDEcpe:/o:google:android:13
n/a n/a≤ n/aenisa_euvdEU
arm valhall gpu kernel driverr29p0 → r38p2nvdUScpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*
arm valhall gpu kernel driver= r39p0nvdUScpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0837Android Patchday April 2023Deutsch2023-04-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, Code auszuführen und einen Denial-of-Service-Zustand zu verursachen.
ASB-A-2544459092023-04-01vendor · osvUS
In kbase_csf_queue_group_suspend_prepare of mali_kbase_csf_kcpu.c , there is a possible out of bounds write due to incorrect memory mapping. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2022-11-08modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan