CVE-2023-6241 is a High severity (CVSS 7.0) use after free in Arm's Midgard, Bifrost, Valhall and Arm 5th Gen GPU kernel drivers. A local, non privileged user can win a race and corrupt memory handling. Update to the driver release named in Arm's security bulletin for your GPU family.
What's affected
The NVD description lists the affected kernel driver ranges for each GPU family.
- Midgard GPU Kernel Driver: r13p0 through r32p0.
- Bifrost GPU Kernel Driver: r11p0 through r25p0.
- Valhall GPU Kernel Driver: r19p0 through r25p0, and r29p0 through r46p0.
- Arm 5th Gen GPU Architecture Kernel Driver: r41p0 through r46p0.
- Fixed: the record does not state the fixed release. Arm's Mali GPU Driver Vulnerabilities page was not retrievable when I fetched it, so read that bulletin for the exact fixed driver version.
- Severity: CVSS 7.0 High. The attack is local and needs a non privileged user on the device.
These versions are driver release numbers from Arm, not Android or Linux version numbers. Phone and device makers ship the Mali driver as part of their own kernel and vendor image, so the fix reaches you through your device vendor's update, not directly from Arm.
How to check if you're exposed
Most teams cannot check this from a package manager, because the driver is part of the device kernel.
- Identify devices with an Arm Mali GPU. Your device vendor's specification sheet lists the GPU family.
- Find the Mali kernel driver version. On Android and embedded Linux builds it often appears in kernel logs or a driver version file, though the location varies by vendor.
- Compare that version with the ranges above and with Arm's bulletin.
- For managed phones, check the security patch level in your mobile device management tool against the vendor's bulletin that lists the CVE.
If you build your own kernels for Mali based boards, check the vendor driver source you import and the release tag it carries.
What to do now
- Read Arm's Mali GPU Driver Vulnerabilities page and note the fixed driver release for your GPU family.
- Apply the device or board vendor's security update that includes the fixed driver. For custom builds, merge the fixed driver release from Arm.
- Prioritize devices where untrusted apps or users can run code, since the attack needs a local user.
- Track which of your device models use Mali GPUs, so the next GPU driver bulletin can be matched quickly.
- Ask device vendors for their patch timeline in writing when a device is outside your direct control.
Why it matters
The weakness is CWE-416, use after free. The description says a software race condition lets a local user cause improper memory processing. If the system's memory is carefully prepared, the race turns into a use after free, where the kernel keeps using memory after it has been released.
GPU drivers run in the kernel and handle memory shared with unprivileged applications. That makes them a regular source of local privilege escalation bugs on phones and embedded devices. The attack still needs a way to run code on the device. For an enterprise fleet that usually means a malicious app or a compromised user session. The kev flag in the record is false, and the Arm text I could use does not describe exploitation in the wild.
Quick check
Can I patch this from the package manager?
Usually not. The driver ships inside the device kernel, so the fix arrives through your device vendor's firmware or security update.
Does this need physical access?
It needs a local non privileged user on the device, such as an app or a user session. It does not need physical access by itself.
Sources
- Arm Mali GPU Driver Vulnerabilities (listed in the record, access denied when fetched)
- NVD record for CVE-2023-6241
Last reviewed: 19 October 2026.
