CVE-2022-38181: Use-After-Free in Arm Mali GPU

CVE-2022-38181 is a use-after-free vulnerability in the Arm Mali GPU kernel driver. An unprivileged user can access memory that has been freed by the driver, due to mishandling of GPU memory operations. Arm Mali is present in billions of devices (smartphones, tablets, automotive, IoT) with Qualcomm Snapdragon, Samsung Exynos, MediaTek, and other processors.

CVSS score is 8.8, classified as high. The vulnerability was published on 2022-10-25; however, on 2026-10-29 signals of public repositories claiming to contain exploits were detected. This resurfacing of public interest, 4 years after disclosure, suggests the issue remains unresolved on many devices in production. Fix details and patched versions are not reported in available NVD data.

For defenders and IT administrators: verify the Arm Mali driver revision number on all enterprise mobile devices and SoCs (consult SoC manufacturer documentation). Request patches from the vendor or device manufacturer. Monitor security announcements from Arm and vendors (Qualcomm, Samsung, MediaTek). On sensitive systems, consider restricting access to the GPU driver for unprivileged users, if the kernel permits.