Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2021-28663 · Published 10/05/2021 · updated 17/06/2026

Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
bifrost gpu kernel driver arm	`≥ r0p0, < r29p0`	`r29p0`
midgard gpu kernel driver arm	`≥ r4p0, < r31p0`	`r31p0`
valhall gpu kernel driver arm	`≥ r19p0, < r29p0`	`r29p0`

Description

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

References

developer.arm.com/support/arm-security-updates · Vendor Advisory
developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver · Vendor Advisory
lntrx/CVE-2021-28663 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-28663

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free