CVE_2022_46395_Gazelle

Exploit for CVE-2022-46395 to run on FireTV 3rd gen Cube This is a fork of security researcher Man Yue Mo's Pixel 6 POC for CVE-2022-46395. Read his detailed write-up of the vulnerability here. Changes have been made to account for FireOS's 32-bit user space. The POC exploits a bug in the ARM Mal...

CVE-2026-12387

CVE-2026-12387 is a Use After Free vulnerability in Arm Mali GPU Kernel Drivers spanning three architectures: Bifrost , Valhall , and Arm 5th Gen GPU Architecture . A local non-privileged user process can perform valid GPU memory processing operations to access already freed memory. Affected driv...

CVE-2026-12285

CVE-2026-12285 is a Use After Free vulnerability in Arm Ltd GPU kernel drivers, specifically affecting the Bifrost , Valhall , and Arm 5th Gen GPU Architecture kernel drivers. A local non-privileged user process can perform valid GPU memory processing operations to access already freed memory. Af...

CVE-2026-11891

A Use After Free vulnerability exists in Arm Ltd's Valhall GPU Userspace Driver and Arm 5th Gen GPU Architecture Userspace Driver , affecting versions r46p0 through r49p5 , r50p0 through r54p3 , and r55p0 . The flaw allows a non-privileged user process to perform valid GPU processing operations—i...

CVE-2026-9040

CVE-2026-9040 is a race condition vulnerability in the Arm Mali GPU Kernel Drivers , affecting three driver families: Bifrost (r12p0–r49p5, r50p0–r51p0, r54p1–r54p2), Valhall (r19p0–r49p5, r50p0–r54p3, r55p0), and the Arm 5th Gen GPU Architecture (r41p0–r49p5, r50p0–r54p3, r55p0). The flaw allows...

CVE-2026-9034

CVE-2026-9034 is a Use After Free vulnerability in Arm Mali GPU Userspace Drivers affecting three architectures: Bifrost (r42p0–r49p5, r50p0–r51p0, r54p1–r54p3), Valhall (r42p0–r49p5, r50p0–r54p3, r55p0), and Arm 5th Gen GPU Architecture (r42p0–r49p5, r50p0–r54p3, r55p0). A non-privileged user pr...

CVE-2026-7477

CVE-2026-7477 is a Use After Free vulnerability in Arm Ltd Mali GPU Kernel Drivers, specifically the Bifrost , Valhall , and 5th Gen GPU Architecture drivers. A local non-privileged user process can perform valid GPU memory processing operations to access already freed memory. Affected version ra...

CVE-2026-7476

CVE-2026-7476 is a Use After Free vulnerability in Arm Ltd Bifrost , Valhall , and 5th Gen GPU Architecture Kernel Drivers . A local non-privileged user process can perform improper GPU memory processing operations to access already freed memory. Affected versions: Bifrost r49p3–r49p5, r51p0, r54...

CVE-2026-5729

CVE-2026-5729 is a Use After Free vulnerability in the Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver , affecting versions r50p0 through r54p3 and r55p0 . A local non-privileged user process can perform valid GPU processing operations to access already freed memo...

CVE-2026-0860

CVE-2026-0860 is an exposure of sensitive information vulnerability in Arm Mali GPU Kernel Drivers (Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver). A local non-privileged user process can perform improper GPU memory processing operations to access sensitive kernel infor...

CVE-2026-0001

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects...

CVE-2026-0001 Mali GPU Kernel Driver allows access to already freed memory

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects...

CVE_2022_38181_Gazelle

Exploit for CVE-2022-38181 to run on FireTV 3rd gen Cube This is a fork of security researcher Man Yue Mo's Pixel 6 POC for CVE202238181. Read his detailed write-up of the vulnerability here. Changes have been made to account for FireOS's 32bit userspace. The POC exploits a bug in the ARM Mali...

CVE-2024-1065

CVE-2024-1065 — Page Cache Exploitation PoC Proof-of-concept exploit for CVE-2024-1065, a physical page use-after-free in the ARM Mali GPU kernel driver. The exploit demonstrates page cache exploitation : racing a freed MIGRATEMOVABLE page into the in-memory code image of a SUID binary, then...

CVE-2022-46395

Exploit for CVE-2022-46395 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in November 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

CVE-2022-20186

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

CVE-2021-28663

CVE-2021-28663 A basic PoC leak for CVE-2021-28663 Internal of the Android kernel backdoor vulnerability This is a basic PoC for CVE-2021-28663. A design flaw in Mali GPU Android Kernel Driver. 1. Create a GPUVA and also mmap to it so we can get virtual addr for phys pages. 2. Create an alias for...

Pixel_GPU_Exploit

Mali GPU 内核 LPE 本文深入分析了 Mali GPU 中的两个内核漏洞，这些漏洞可从默认应用沙箱中触达，由我独立发现并报告给 Google。文中包含一个可实现任意内核读写（r/w）能力的内核利用程序。该利用程序可禁用 SELinux，并在运行以下 Android 14 版本的 Google Pixel 7 和 8 Pro 机型上提权至 root： Pixel 8 Pro: google/husky/husky:14/UD1A.231105.004/11010374:user/release-keys Pixel 7 Pro:...

CVE-2022-22706-poc

CVE-2022-22706 - 页缓存写入 Arm Mali GPU 驱动会将已固定为只读的页面以 CPU 可写映射的形式交给用户空间， 因此非特权进程可以获得一个可写别名，指向某个它只能以 ORDONLY 打开的文件 背后的页缓存。 exploit.c 会清空 /etc/passwd 页缓存中 root 的密码字段，并执行 su root。磁盘上的文件从未被修改。 针对本仓库中的驱动树和 QEMU 目标的 PoC（malikbase r35p0-01eac0 ， CONFIGMALINOMALI=y，x8664 GKI 5.15）。在虚拟机中运行它。 漏洞...

CVE-2022-20186_CTXZ

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...