CVE-2023-5249 is a high severity (CVSS 7.0) use after free in the Arm Bifrost and Valhall GPU kernel drivers, releases r35p0 through r40p0. A local unprivileged user can trigger it through a race condition. Check the Arm advisory for the fixed driver release and install your device vendor update.
What's affected
The NVD record says a use after free vulnerability in the Arm Bifrost GPU Kernel Driver and the Valhall GPU Kernel Driver allows a local non privileged user to make improper memory processing operations that exploit a software race condition. If the memory is carefully prepared by the user, this causes a use after free.
The record gives the affected range as r35p0 through r40p0 for both drivers. The reference is the Arm Security Center page on Mali GPU driver vulnerabilities. That page blocked automated access when we reviewed this entry, so we cannot name the first fixed driver release. Read the Arm page for it.
Most people do not install GPU drivers from Arm directly. Phone and device makers ship them inside system images, so the update you need comes from the device manufacturer or the carrier.
How to check if you're exposed
For Android devices, check the security patch level in Settings, then About phone, and compare it with the patch bulletin of your vendor.
For fleets, use your management tool to report model, Android version and security patch level, then sort by those that are behind.
Ask your device supplier whether the GPU driver in your models falls in the affected range and which update carries the fix.
Treat devices that no longer receive updates as exposed to local flaws like this one.
What to do now
- List devices that use Mali GPUs with Bifrost or Valhall architectures.
- Read the Arm Security Center page for the first fixed driver release.
- Install the vendor update that includes the fix, and verify the patch level.
- Limit app installs to trusted sources, since the attacker needs local code.
- Retire devices that no longer get security updates.
Why it matters
The record maps this to CWE-416, use after free. Memory is freed while another thread still holds a pointer to it, and the race lets a crafted sequence of operations reuse that memory in ways the driver did not intend.
GPU drivers run in the kernel and are reachable from ordinary apps, which makes them a useful path for local privilege escalation. The score is high rather than critical because the attacker already needs code on the device and must win a race. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Do I install the fix from Arm?
Usually not. Device makers ship the driver in system updates, so install the update from your vendor and check the patch level.
Sources
Last reviewed: 19 October 2026.
