CVE-2021-28663: Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 12.1% chance of exploitation in the next 30 days.

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

Affected products

• Arm Bifrost GPU Kernel Driver: from r0p0, before r29p0 (fixed in r29p0)
• Arm Midgard GPU Kernel Driver: from r4p0, before r31p0 (fixed in r31p0)
• Arm Valhall GPU Kernel Driver: from r19p0, before r29p0 (fixed in r29p0)

Published 2021-05-10. Last modified 2026-06-17.