Arm Mali CVE-2024-4610: Exploited Bifrost/Valhall Driver UAF

What to do

1. Inventory devices with Mali GPUs (adb shell getprop ro.hardware.egl usually returns mali).
2. Read each device's Mali driver release from adb shell dumpsys SurfaceFlinger | grep -i GLES and flag r34 through r40 builds.
3. Update flagged devices, or retire them if the vendor no longer ships updates.
4. For embedded and OEM products, ask the SoC or board vendor to confirm the kernel driver is r41p0 or later.
5. Enforce a rolling minimum Android security patch level so stale GPU drivers do not linger.

How to check if you are affected or compromised

• Arm published no indicators of compromise or attack details as of Oct 23, 2026; driver version is the main signal.
• Exploitation needs code running on the device, so review sideloaded or unknown apps on exposed devices.
• For high-risk users on exposed devices, arrange a professional mobile forensic review.

What happened#

On June 7, 2024, Arm published CVE-2024-4610, a use-after-free in its Bifrost and Valhall Mali GPU kernel drivers. According to the CVE record, a local non-privileged user can make improper GPU memory processing operations to reach already freed memory. Arm said the flaw has been actively exploited in the wild, as reported by The Hacker News. CISA added it to the KEV catalog on June 12, 2024, with a July 3 deadline.

Unusually, the fix is older than the CVE. Arm's driver r41p0, released November 24, 2022, already closes the bug. Arm told The Hacker News that "an external researcher recently provided new information which reclassifies this weakness as a vulnerability." In other words, a change Arm shipped in 2022 as an ordinary fix later turned out to be security-relevant. As of Oct 23, 2026, Arm has not named the researcher, the attacker or the targets. This is a different bug from CVE-2023-4211, the Mali zero-day of October 2023.

Who is affected#

The CVE record's affected data lists:

• Bifrost GPU kernel driver r34p0 through r40p0. r41p0 is unaffected.
• Valhall GPU kernel driver r34p0 through r40p0. r41p0 is unaffected.

Midgard and Arm 5th Gen drivers are not listed. What matters is the driver release a device vendor actually built into its kernel. Arm does not publish a device list, and I found no Android Security Bulletin entry for this CVE. As a result, no single Android patch level marks a device as safe. NVD scores the bug CVSS 3.1 7.8, and CISA's ADP score is 7.4.

Do you really need to act?#

For most current devices, no. The fix has been available for almost four years. Phones that kept receiving vendor updates very likely moved past r40p0 long ago. Because there is no bulletin to point to, "very likely" is the honest wording.

Exposure sits with Mali devices whose kernels froze on driver r34p0 through r40p0: phones and tablets past end of support, low-cost tablets, Android TV boxes, kiosks and rugged devices, and embedded Linux boards. An attacker still needs code running on the device first, such as a malicious or compromised app. The bug then provides the kernel step. Arm has not described the attacks, but local kernel bugs like this are normally one step in a targeted chain, not a mass-exploitation tool.

What to do now#

1. Find Mali devices. adb shell getprop ro.hardware.egl usually returns mali.
2. Read the driver release. adb shell dumpsys SurfaceFlinger | grep -i GLES shows the GPU and a driver string that normally includes the release (for example r40p0). Flag r34 through r40 builds.
3. Update flagged devices. If the vendor no longer ships updates, retire them or keep them away from corporate data.
4. For embedded and OEM products, ask the SoC or board vendor in writing whether the kernel driver is r41p0 or later.
5. Enforce a rolling minimum patch level, for example adb shell getprop ro.build.version.security_patch no older than a few months, so stale GPU drivers do not linger.

How to tell if you were hit#

Arm published no indicators of compromise. Because the bug is local, the first sign of an attack would be whatever got code onto the device. On exposed devices, review installed apps for sideloaded or unknown packages, for example with adb shell pm list packages -i to show installer sources. For high-risk users whose devices ran r34p0–r40p0 drivers, arrange a professional mobile forensic review. On-device checks will not reliably reveal a kernel compromise.

Timeline#

• Nov 24, 2022 — Arm releases Bifrost and Valhall driver r41p0, which contains the fix.
• Jun 7, 2024 — Arm publishes CVE-2024-4610 and says it has been exploited in the wild.
• Jun 12, 2024 — CISA adds CVE-2024-4610 to KEV.
• Jul 3, 2024 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2024-4610 · KEV 2024-06-12 · Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE record — CVE-2024-4610 (Arm) cve.org
2. CVE Program — CVE-2024-4610 record (JSON) cveawg.mitre.org
3. NVD — CVE-2024-4610 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2024-4610 cisa.gov

Coverage and analysis

1. The Hacker News — Arm Warns of Actively Exploited Zero-Day Vulnerability in Mali GPU Drivers thehackernews.com