CVE-2024-4610highunder attackCWE-416

CVE-2024-4610: high-severity vulnerability in Arm Ltd Bifrost GPU Kernel Driver

Mali GPU Kernel Driver allows improper GPU memory processing operations

Published · Updated

Follow this CVE+ Monitor Valhall GPU Kernel Driver+ Monitor Bifrost GPU Kernel Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.4epss 0.8%
from disclosure to weapon
Published on NVDJun 7
CISA KEV+5d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
5 products (276 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
Action required by CISAfederal deadline: 2024-07-03

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A use-after-free vulnerability in Mali GPU drivers allows a local user to access GPU memory that has already been freed, potentially exposing sensitive data or causing system instability.

Technical detail

Use-after-free vulnerability (CWE-416) in Arm Bifrost and Valhall GPU Kernel Drivers (versions r34p0-r40p0) triggered by improper GPU memory processing operations. Local non-privileged user can access freed GPU memory regions, leading to information disclosure or denial of service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Arm Ltd · Bifrost GPU Kernel DriverArm Ltd · Valhall GPU Kernel Driver
Related CVEs — Arm Ltd Bifrost GPU Kernel Driver

In the same product, most dangerous first.

CVE-2023-4211MEDIUMMali GPU Kernel Driver Allows Improper GPU Memory Processing OperationsEPSS 1.0%KEVCVE-2023-6241HIGHMali GPU Kernel Driver allows improper GPU memory processing operationsEPSS 0.7%CVE-2026-0860HIGHMali GPU Kernel Driver allows access to sensitive kernel informationEPSS 0.4%CVE-2025-0072HIGHMali GPU Kernel Driver allows improper GPU memory processing operationsEPSS 0.4%CVE-2025-3212MEDIUMMali GPU Kernel Driver allows access to already freed memoryEPSS 0.3%CVE-2023-4272MEDIUMMali GPU Kernel Driver exposes sensitive data from freed memoryEPSS 0.3%