ZeroDay Findings
Sign inSign up

Findings

CVE-2021-28663

Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

Published May 10, 2021 · updated Jun 16, 2026 · arm bifrost gpu kernel driver

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

Timeline

Detection, updates, and resolution for this record.

  1. May 10, 2021 · Catalog

    Detected

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe arm/bifrost gpu kernel driverversion unspecified
  • cpe arm/midgard gpu kernel driverversion unspecified
  • cpe arm/valhall gpu kernel driverversion unspecified
  • vendor Arm Mali Graphics Processing Unit (GPU)version unspecified

Sources

  • CISA KEVCVE-2021-28663

    Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.

    cisa.gov
  • CVE.orgCVE-2021-28663

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-28663

    30-day exploitation probability 12.1%

    first.org
  • NIST NVDCVE-2021-28663

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through

    nvd.nist.gov

References

CVE-2021-28663 · ZeroDay Findings