---
title: "Arm Mali CVE-2024-4610: Exploited Bifrost/Valhall Driver UAF"
url: https://erroneo.us/security/briefs/arm-mali-cve-2024-4610-bifrost-valhall-uaf/
description: "Use-after-free in Arm Bifrost/Valhall GPU kernel drivers r34p0-r40p0, exploited in the wild. Fixed in r41p0 back in 2022. Check devices on stale Mali drivers."
type: security-brief
section: "Security Digest"
date_published: 2024-06-07
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-4610"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Arm Mali CVE-2024-4610: Exploited Bifrost/Valhall Driver UAF

**Verdict: Check exposure.** The fix has existed since November 2022, so updated devices are almost certainly fine; the risk sits in Mali devices whose vendor kernels froze on driver r34p0 to r40p0.

- **Who must act:** Owners of Android phones, tablets, TV boxes and embedded Linux devices with Bifrost or Valhall Mali GPUs that no longer get updates or whose driver version is unknown.
- **Who can relax:** Devices without Mali GPUs, devices on Midgard or Arm 5th Gen drivers for this CVE, and supported devices that kept receiving monthly updates.
- **Affected:** Bifrost GPU kernel driver r34p0 through r40p0; Valhall GPU kernel driver r34p0 through r40p0; Devices whose vendor kernel ships those driver releases
- **Fixed:** Bifrost and Valhall GPU kernel driver r41p0 (released Nov 24, 2022) and later
- **CVEs:** CVE-2024-4610
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory devices with Mali GPUs (adb shell getprop ro.hardware.egl usually returns mali).
2. Read each device's Mali driver release from adb shell dumpsys SurfaceFlinger | grep -i GLES and flag r34 through r40 builds.
3. Update flagged devices, or retire them if the vendor no longer ships updates.
4. For embedded and OEM products, ask the SoC or board vendor to confirm the kernel driver is r41p0 or later.
5. Enforce a rolling minimum Android security patch level so stale GPU drivers do not linger.

### How to check if you are affected

- Arm published no indicators of compromise or attack details as of Oct 23, 2026; driver version is the main signal.
- Exploitation needs code running on the device, so review sideloaded or unknown apps on exposed devices.
- For high-risk users on exposed devices, arrange a professional mobile forensic review.

## What happened

On June 7, 2024, Arm published CVE-2024-4610, a use-after-free in its Bifrost and Valhall Mali GPU kernel drivers. According to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-4610), a local non-privileged user can make improper GPU memory processing operations to reach already freed memory. Arm said the flaw has been actively exploited in the wild, as reported by [The Hacker News](https://thehackernews.com/2024/06/arm-warns-of-actively-exploited-zero.html). CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4610) on June 12, 2024, with a July 3 deadline.

Unusually, the fix is older than the CVE. Arm's driver r41p0, released November 24, 2022, already closes the bug. Arm told The Hacker News that "an external researcher recently provided new information which reclassifies this weakness as a vulnerability." In other words, a change Arm shipped in 2022 as an ordinary fix later turned out to be security-relevant. As of Oct 23, 2026, Arm has not named the researcher, the attacker or the targets. This is a different bug from CVE-2023-4211, the Mali zero-day of October 2023.

## Who is affected

The [CVE record's affected data](https://cveawg.mitre.org/api/cve/CVE-2024-4610) lists:

- Bifrost GPU kernel driver r34p0 through r40p0. r41p0 is unaffected.
- Valhall GPU kernel driver r34p0 through r40p0. r41p0 is unaffected.

Midgard and Arm 5th Gen drivers are not listed. What matters is the driver release a device vendor actually built into its kernel. Arm does not publish a device list, and I found no Android Security Bulletin entry for this CVE. As a result, no single Android patch level marks a device as safe. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-4610) scores the bug CVSS 3.1 7.8, and CISA's ADP score is 7.4.

## Do you really need to act?

For most current devices, no. The fix has been available for almost four years. Phones that kept receiving vendor updates very likely moved past r40p0 long ago. Because there is no bulletin to point to, "very likely" is the honest wording.

Exposure sits with Mali devices whose kernels froze on driver r34p0 through r40p0: phones and tablets past end of support, low-cost tablets, Android TV boxes, kiosks and rugged devices, and embedded Linux boards. An attacker still needs code running on the device first, such as a malicious or compromised app. The bug then provides the kernel step. Arm has not described the attacks, but local kernel bugs like this are normally one step in a targeted chain, not a mass-exploitation tool.

## What to do now

1. Find Mali devices. `adb shell getprop ro.hardware.egl` usually returns `mali`.
2. Read the driver release. `adb shell dumpsys SurfaceFlinger | grep -i GLES` shows the GPU and a driver string that normally includes the release (for example `r40p0`). Flag r34 through r40 builds.
3. Update flagged devices. If the vendor no longer ships updates, retire them or keep them away from corporate data.
4. For embedded and OEM products, ask the SoC or board vendor in writing whether the kernel driver is r41p0 or later.
5. Enforce a rolling minimum patch level, for example `adb shell getprop ro.build.version.security_patch` no older than a few months, so stale GPU drivers do not linger.

## How to tell if you were hit

Arm published no indicators of compromise. Because the bug is local, the first sign of an attack would be whatever got code onto the device. On exposed devices, review installed apps for sideloaded or unknown packages, for example with `adb shell pm list packages -i` to show installer sources. For high-risk users whose devices ran r34p0–r40p0 drivers, arrange a professional mobile forensic review. On-device checks will not reliably reveal a kernel compromise.

## Timeline

- Nov 24, 2022 — Arm releases Bifrost and Valhall driver r41p0, which contains the fix.
- Jun 7, 2024 — Arm publishes CVE-2024-4610 and says it has been exploited in the wild.
- Jun 12, 2024 — CISA adds CVE-2024-4610 to KEV.
- Jul 3, 2024 — CISA's remediation deadline for federal agencies.

## Sources

1. [CVE record — CVE-2024-4610 (Arm)](https://www.cve.org/CVERecord?id=CVE-2024-4610)
2. [CVE Program — CVE-2024-4610 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2024-4610)
3. [NVD — CVE-2024-4610](https://nvd.nist.gov/vuln/detail/CVE-2024-4610)
4. [CISA — Known Exploited Vulnerabilities: CVE-2024-4610](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4610)
5. [The Hacker News — Arm Warns of Actively Exploited Zero-Day Vulnerability in Mali GPU Drivers](https://thehackernews.com/2024/06/arm-warns-of-actively-exploited-zero.html)

---
Source page: https://erroneo.us/security/briefs/arm-mali-cve-2024-4610-bifrost-valhall-uaf/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt