Loading vulnerability…
Use-After-Free in Arm Mali GPU Kernel Driver kbase_jit_grow
CVE-2023-6241 is a use-after-free vulnerability in Arm Mali GPU kernel drivers affecting Midgard, Bifrost, Valhall, and Arm 5th Gen GPU Architecture driver branches. The flaw is rooted in a race condition in the JIT memory growth path, specifically in the kbase_jit_grow function. During growth of a GPU memory region, the driver caches the current allocation size before dropping locks to refill the memory pool. If a concurrent page fault grows the same region during that race window, the driver later resumes using stale size information while other code paths use the updated allocation state. This inconsistency can cause physical pages to be allocated and tracked differently from how GPU mappings are established, leaving some pages backed but unmapped. Subsequent shrinking and teardown operations can then free physical pages while stale mappings remain accessible, producing a page-level use-after-free condition. A local unprivileged attacker who can carefully shape memory state and trigger the race can exploit the bug to obtain powerful kernel memory manipulation primitives.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to arbitrary kernel memory read and write and ultimately arbitrary kernel code execution. On affected Android devices, this can be used by a local unprivileged application to escalate privileges to root, bypass security controls such as SELinux enforcement, and fully compromise the device. Because the flaw occurs in a kernel driver, compromise affects kernel integrity and can enable persistence, credential theft, tampering with security policy, and broad access to protected system resources.
If you can’t patch tonight, do this now.
Until patched drivers are deployed, reduce exposure by limiting execution of untrusted local code on affected devices, especially application sideloading and other pathways that allow attacker-controlled code to run in an unprivileged app context. Enforce timely mobile device patching, restrict developer or test builds in production environments, and use application control or enterprise mobility controls to reduce the likelihood of local exploitation. Monitoring for abnormal GPU driver faults or repeated memory-management anomalies may help detect exploitation attempts, but mitigation is incomplete without patching.
Patch, then assume compromise.
Upgrade to a fixed Arm Mali GPU kernel driver release outside the affected version ranges. The corrective change revalidates whether growth is still required after the race window and recalculates allocation and mapping parameters using the current allocation state rather than stale cached values. Device vendors should integrate the upstream fix into their kernel trees and distribute updated firmware or operating system builds. For Android deployments, apply the relevant vendor and platform security updates that include the patched GPU driver.
2 exploits validated by Mallory's analysis. Hidden: 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.