The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory…
Priority CRITICAL 97Exploited in the wildCWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2021-11-17
EPSS 0.05451 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:* | r0p0 to before r29p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:* | r8p0 to before r31p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* | r19p0 to before r29p0 | Vulnerable | Arm |
- cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r0p0 to before r29p0 Vulnerable ·Arm
- cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r8p0 to before r31p0 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* Versions r19p0 to before r29p0 Vulnerable ·Arm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-28664
- 2026-10-03 Alias added: GHSA-w62f-9gm7-596f
References
More Arm Bifrost Gpu Kernel Driver vulnerabilities
- TI-2022-17875 The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because… KEVCVSS 3.1HIGH 8.8
- TI-2021-10068 . KEVCVSS 3.1HIGH 8.8
- TI-2021-09731 The Arm Mali GPU kernel driver allows privilege escalation or information disclosure… KEVCVSS 3.1HIGH 8.8
- TI-2024-04292 Mali GPU Kernel Driver allows improper GPU memory processing operations KEVCVSS 3.1HIGH 7.8
- TI-2022-06958 Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to… KEVCVSS 3.1HIGH 7.8
- TI-2023-03898 Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations KEVCVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-28664 · CVE Program
- CVE-2021-28664 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-w62f-9gm7-596f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences