CVE-2024-4610: Arm Mali GPU kernel driver use-after-free lets local user access freed memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a kernel use-after-free with high confidentiality, integrity and availability impact and confirmed exploitation per CISA KEV, though it requires local access.

What it is

The Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free (CWE-416) reachable by a local non-privileged user performing improper GPU memory operations. The flaw spans driver releases r34p0 through r40p0. Because it is a kernel memory-safety bug, successful abuse can corrupt or read freed GPU memory, which is a serious local privilege-escalation primitive.

Impact

An attacker gains access to already freed GPU memory, enabling memory disclosure and corruption that can lead to privilege escalation or code execution in kernel context. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so any local non-privileged process able to issue GPU memory operations can reach the flaw. No network or remote path is described.

Exploitation

CVE-2024-4610 was added to CISA KEV on 2024-06-12 with a 2024-07-03 remediation due date, indicating known exploitation in the wild. EPSS is low (0.00758, ~53rd percentile), and no ransomware campaign use is documented.

What to do

• Apply the Arm Mali GPU driver update that resolves the use-after-free for Bifrost and Valhall releases r34p0 through r40p0, per the Arm Security Center advisory.
• If a patched driver is not available for the device, discontinue use of the affected product as directed by CISA KEV required action.
• Restrict local access to affected devices and limit untrusted code execution, since exploitation requires only a local non-privileged user.
• Track the CISA KEV due date (2024-07-03) and confirm remediation status across all devices using the affected drivers.

Detection

• Monitor for crashes or anomalous behavior in GPU driver processes that may indicate use-after-free access.
• Audit which devices run Bifrost or Valhall GPU kernel drivers in the r34p0 to r40p0 range and verify patch state.
• Watch for local privilege-escalation activity originating from non-privileged processes interacting with GPU memory operations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.