Medium severity · published Oct 1, 2023
CVE-2023-4211
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
In wildKEV
5.5
CVSS
1.1%
EPSS
Yes
On KEV
Description
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 3, 2023
Federal remediation dueOct 24, 2023
Ransomware campaign useNot known
Affected products
Which versions
A5
Arm 5th Gen GPU Architecture Kernel Driver · Arm Ltd
r41p0 through r42p0 · source: vendor
BG
Bifrost GPU Kernel Driver · Arm Ltd
r0p0 through r42p0 · source: vendor, NVD
MG
Midgard GPU Kernel Driver · Arm Ltd
r12p0 through r32p0 · source: vendor, NVD
VG
Valhall GPU Kernel Driver · Arm Ltd
r19p0 through r42p0 · source: vendor, NVD
5G
5th Gen Gpu Architecture Kernel Driver · Arm
r41p0 before r43p0 · source: NVD
MG
Mali GPU Kernel Driver · Arm
All versions, or not specified · source: KEV
Affected product
A5
Arm 5th Gen GPU Architecture Kernel Driver
Arm Ltd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4211
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
developer.arm.com
https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
More from Arm 5th Gen GPU Architecture Kernel Driver
7.8
CVE-2026-7477
Mali GPU Kernel Driver allows access to already freed memory
7.8
CVE-2026-7476
Mali GPU Kernel Driver allows access to already freed memory
7.8
CVE-2026-5729
Mali GPU Kernel Driver allows access to already freed memory
7.8
CVE-2024-3655
Mali GPU Kernel Driver allows improper GPU memory processing operations
7.7
CVE-2026-9040
Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information