CVE-2021-29256
Published 2021-05-24 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2021-29256 is a high-severity (CVSS 8.8) vulnerability in Arm Mali Graphics Processing Unit (GPU). CISA added it to the Known Exploited Vulnerabilities catalog on July 7, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 28, 2023. CISA does not currently list it as used in ransomware campaigns. Arm has 9 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 9 known-exploited Arm vulnerabilities →Description
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Arm — Mali Graphics Processing Unit (GPU)
Name: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Date added: 2023-07-07 · Due: 2023-07-28
Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.