Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations

published 2023-10-01 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-54085

cvss: 5.5; version 3.1, CNA
cisa kev: Exploited; added 2023-10-03
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

fixed in 3

arm 5th_gen_gpu_architecture_kernel_driver r43p0
arm bifrost_gpu_kernel_driver r43p0
arm valhall_gpu_kernel_driver r43p0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4211 updated 2026-11-07 cvss 7.4

kernel: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2023-10-01 Published
2023-10-02 0-day patched (Project Zero)
2023-10-03 Added to CISA KEV
2023-10-24 CISA patch deadline
2023-11-15 CISA SSVC: exploitation active

Known exploited

Added: 3 y ago (2023-10-03)
Patch by: 2023-10-24 (3 y ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: Arm, Mali GPU Kernel Driver
CISA name: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched: 2023-10-02
Details: project zero root cause analysis

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 2 y ago (2023-11-15)

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Arm Ltd Midgard GPU Kernel Driver
Arm Ltd Bifrost GPU Kernel Driver
Arm Ltd Valhall GPU Kernel Driver
Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver

Classification

Weakness

CWE-416 Use After Free

References

developer.arm.com /Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211
government-resource, us-government-resource

Sources

CVE List CVE-2023-4211
NVD CVE-2023-4211

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary