Use-after-free in ARM products - CVE-2023-6241
Published: March 4, 2024 / Updated: July 3, 2025
Vulnerability identifier: #VU87035
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-6241
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error. A local user can trigger a use-after-free error and execute arbitrary code on the system.
Affected software
Bifrost GPU Kernel Driver
Midgard GPU Kernel Driver
Valhall GPU Kernel Driver
Arm 5th Gen GPU Architecture Kernel Driver
Google Android
Midgard GPU Kernel Driver
Valhall GPU Kernel Driver
Arm 5th Gen GPU Architecture Kernel Driver
Google Android
How to mitigate CVE-2023-6241
Install updates from vendor's website.
Bifrost GPU Kernel Driver - update to r26p0
Valhall GPU Kernel Driver - addressed in versions r26p0, r47p0
Arm 5th Gen GPU Architecture Kernel Driver - update to r47p0
Google Android - addressed in versions 11 2024-03-05, 12L 2024-03-05, 12 2024-03-05, 13 2024-03-05, 14 2024-03-05
Valhall GPU Kernel Driver - addressed in versions r26p0, r47p0
Arm 5th Gen GPU Architecture Kernel Driver - update to r47p0
Google Android - addressed in versions 11 2024-03-05, 12L 2024-03-05, 12 2024-03-05, 13 2024-03-05, 14 2024-03-05