Loading story…
Arm disclosed that CVE-2024-4610 affects Mali Bifrost and Valhall GPU kernel drivers and is being actively exploited in the wild. The flaw allows a local unprivileged attacker to access deallocated GPU memory, leading to improper GPU memory operations that can expose sensitive data and potentially enable arbitrary code execution.
The vulnerable versions span r34p0 through r40p0 for both affected driver lines. Arm and CSIRT.SK urged users and device vendors to update immediately to r41p0 or later, with r49p0 identified as the current version, to mitigate the risk from ongoing exploitation.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Arm identified vulnerable Mali Bifrost and Valhall driver versions as r34p0 through r40p0 and advised users to update to at least r41p0, with r49p0 noted as the current version. This guidance was issued as the remediation for CVE-2024-4610.
Arm disclosed CVE-2024-4610 affecting Mali Bifrost and Valhall GPU kernel drivers, stating the vulnerability had been observed in active exploitation. The flaw can allow a local unprivileged attacker to access deallocated GPU memory, creating risks including arbitrary code execution and unauthorized access to sensitive data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arm disclosed **CVE-2025-10263**, a critical flaw in many Arm CPU cores that can let memory accesses complete incorrectly during permission changes, creating a path for writes to resources owned by a higher exception level. The issue stems from a timing condition in TLB invalidation handling where completion of a `TLBI` is not guaranteed to mean all affected memory accesses have completed, leaving stale translations usable across privilege boundaries. Affected processors include multiple **Arm Neoverse** and **Cortex** cores as well as **NVIDIA Olympus**, and the flaw has implications for Stage 1, Stage 2, and **GPT** protections used for memory isolation and virtualization. Vendors and projects released coordinated advisories and patches after disclosure. **Linux** posted kernel fixes implementing Arm's software workaround, which adds an extra `TLBI` and `DSB` in certain invalidation paths, while **NVIDIA** issued a related mitigation for Olympus-based Vera CPUs. **Xen** published **XSA-493 v2**, warning that on multi-core Arm systems a malicious guest could potentially keep writing after Stage 2 permissions were changed, enabling hypervisor-level privilege escalation; patches were released for `xen-unstable` and supported stable branches from **Xen 4.17** through **4.21**. **FreeBSD** also issued an `arm64` security advisory covering the hardware issue.
Jun 29, 2026
**CVE-2023-52817** is a moderate-severity flaw in the Linux kernel's AMDGPU DRM driver. On affected GPUs, including VEGA20, a low-privileged local user can read the `amdgpu_regs_smc` debugfs file while the `smc_rreg` pointer is NULL, triggering a NULL-pointer dereference in `amdgpu_debugfs_regs_smc_read` and causing a kernel oops or system crash. Red Hat rates the local denial-of-service issue CVSS 3.1 5.5. The vulnerability is fixed in Linux stable releases 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later. Red Hat issued standard-kernel fixes for RHEL 8 and RHEL 9, plus the RHEL 8 real-time kernel, through advisories including RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:9315; RHEL 9 `kernel-rt` was listed as affected. Administrators should deploy the latest vendor-supported kernel update rather than backporting individual patches.
Aug 26, 2026
STAR Labs detailed two exploit chains showing how vulnerabilities in the Arm Mali GPU driver could be turned into full kernel compromise on Google Pixel phones. One write-up analyzed `CVE-2023-6241`, a race condition in `kbase_jit_grow` on a Pixel 8 running Android 14, where stale allocation state after a lock drop left some physical pages backed but unmapped. That inconsistency was used to trigger a page use-after-free, reclaim the freed page, and build arbitrary kernel read/write primitives. The exploit then overwrote kernel code to disable SELinux enforcement and invoked `commit_creds(&init_cred)` to gain root from the unprivileged `untrusted_app_27` context; STAR Labs said excessive `WARN_ON` logging initially stretched exploitation to about 10 minutes before testing reduced runtime to under five seconds. A second write-up showed that `CVE-2023-48409` alone was sufficient to compromise a Pixel 6 Pro, contradicting earlier assumptions that exploitation also required `CVE-2023-26083`. STAR Labs described the bug as an integer-overflow-driven out-of-bounds write in the Pixel Mali driver and said exploitation bypassed `CONFIG_HARDENED_USERCOPY` by targeting page-allocator-backed objects and using pagetable spraying techniques inspired by Dirty Pagetable. The researchers also mapped Android-specific constraints including seccomp, SELinux, and privilege-escalation mechanics, and found that while the earlier pointer-leak bug still existed on affected devices, the practical path relied on leaking a `kbase_context` object exposing a `task_struct` pointer for direct credential manipulation. Both reports said the affected issues were patched in later Android security updates.
Jun 29, 2026