CVE-2024-4610

KEVArm Mali GPU Kernel Driver Use-After-Free Vulnerability

Description

Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedJun 7, 2024

Last modifiedJun 17, 2026

Added to KEVJun 12, 2024

Remediation dueJul 3, 2024

References

developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4610US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 845 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 0.76% · top 45% of all CVEs
Weakness: CWE-416

Recommended actions

1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.