{"id":"CVE-2021-29256","kind":"vulnerability","aliases":["CVE-2021-29256"],"related":[],"title":"Arm Mali Graphics Processing Unit (GPU): Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","description":". The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.","summary":"Arm Mali GPU kernel driver has a use-after-free bug that lets a local non-privileged user gain root and/or read kernel information. CISA lists it as actively exploited.","severity":"critical","cvss":9.0,"epss":null,"exploited":true,"exploited_at":"2023-07-07T00:00:00+00:00","products":[{"name":"Arm Mali Graphics Processing Unit (GPU)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"arm bifrost gpu kernel driver","fixed":["r30p0"],"affected":">= r16p0, < r30p0","ecosystem":"vendor"},{"name":"arm midgard gpu kernel driver","fixed":["r31p0"],"affected":">= r28p0, < r31p0","ecosystem":"vendor"},{"name":"arm valhall gpu kernel driver","fixed":["r30p0"],"affected":">= r19p0, < r30p0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","arm-mali","embedded-linux","exploited","infrastructure","kernel"],"not_affected_if":["no-mali-gpu-driver"],"how_to_check":null,"fix":"Apply the vendor update per Arm's advisory, or stop using affected devices if no update exists (per CISA KEV required action).","status":"open","published_at":"2021-05-24T18:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:22+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Arm's advisory, or stop using affected devices if no update exists (per CISA KEV required action).","reach":"local","impact":"high","summary":"Arm Mali GPU kernel driver has a use-after-free bug that lets a local non-privileged user gain root and/or read kernel information. CISA lists it as actively exploited.","category":"infrastructure","who_cares":["android","arm-mali","embedded-linux","kernel"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user escalates to root and reads kernel memory","analyst_note":"Find the affected Mali driver versions and fixed releases in Arm's security bulletin for CVE-2021-29256; sources give no version or check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-mali-gpu-driver"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2842,"output_tokens":336,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':18A,21A '-29256':19A,22A 'access':98C 'achiev':97C 'activ':84B 'affect':111C 'allow':92C 'and/or':76B 'android':44B 'arm':1A,7A,23A,29A,34A,39A,46B,54B,87C 'arm-mali':45B 'bifrost':30A,112C 'bug':65B 'cisa':80B 'cve':17A,20A 'disclosur':105C 'driver':11A,33A,38A,43A,58B,91C 'embed':49B 'embedded-linux':48B 'escal':109C 'exploit':51B,85B 'free':15A,64B 'freed':100C 'gain':74B 'gpu':6A,9A,28A,31A,36A,41A,56B,89C 'graphic':3A 'graphics':25A 'inform':79B,104C 'infrastructur':52B 'kernel':10A,32A,37A,42A,53B,57B,78B,90C 'lead':102C 'let':67B 'linux':50B 'list':81B 'local':69B 'mali':2A,8A,24A,47B,55B,88C 'memori':101C 'midgard':35A,125C 'non':71B 'non-privileg':70B 'privileg':72B,108C 'process':4A 'processing':26A 'r16p0':113C 'r19p0':119C 'r28p0':126C 'r29p0':115C,121C 'r30p0':117C,123C,128C 'read':77B 'root':75B,107C 'unit':5A,27A 'unprivileg':94C 'use':13A,62B 'use-after-fre':12A,61B 'user':73B,95C 'valhal':118C 'valhall':40A 'vulner':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-24T18:15:08+00:00","kev":{"dateAdded":"2023-07-07","dueDate":"2023-07-28","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-29256","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-29256","severity":null,"published_at":"2023-07-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-29256","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29256","severity":null,"published_at":"2021-05-24T18:15:08+00:00","modified_at":"2026-06-17T03:47:27+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}