CVE-2024-1395 json
Mali GPU Kernel Driver allows improper GPU memory processing operations
published 2024-05-03 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-17151
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory. This issue affects Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.
Patch / fix
- Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver r48p0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
- Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver
- arm 5th_gen_gpu_architecture_kernel_driver
Classification
- Weakness
-
- CWE-416 Use After Free
References
Sources
- CVE List CVE-2024-1395
- NVD CVE-2024-1395
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.