CVE-2022-28348

Name: CVE-2022-28348
Creator: NVD / NIST
Published: 2022-05-19T01:15:06.803+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 1.27%

Last modified Jun 17, 2026

CVE-2022-28348 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.. EPSS estimates a 1.27% chance of exploitation in the next 30 days.

Description

Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.27%

66.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-416

Affected Software

Vendor	Product	Versions
Arm	Bifrost Gpu Kernel Driver	>= r0p0, <= r36p0
Arm	Midgard Gpu Kernel Driver	>= r4p0, <= r31p0
Arm	Valhall Gpu Kernel Driver	>= r19p0, <= r36p0

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
https://developer.arm.com/support/arm-security-updatesVendor Advisory
https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
https://developer.arm.com/support/arm-security-updatesVendor Advisory

Timeline

Published: May 19, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-28348?

How severe is CVE-2022-28348?

CVE-2022-28348 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.27% probability of exploitation in the next 30 days.

How do I fix CVE-2022-28348?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-28348?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST