Arm vulnerabilities in CISA KEV
Arm has 9 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 28th highest of any vendor. none were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 21), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Mali Graphics Processing Unit (GPU), with 6 entries. Other frequently affected products: Mali GPU Kernel Driver (2); Trusted Firmware (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor arm --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
9
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2024-06-12
most recent entry
┌─ last 12 months
0
entries added
┌─ ransomware use
0 of 9
0% linked to ransomware
┌─ distinct products
3
affected products
$ awk -F, {print $1} /var/log/kev/arm.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 3 | 0 |
| 2023 | 5 | 0 |
| 2024 | 1 | 0 |
$ sort /var/log/kev/arm.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Mali Graphics Processing Unit (GPU) 6 entries
- Mali GPU Kernel Driver 2 entries
- Trusted Firmware 1 entry
$ kev-due-dates --vendor arm
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Arm
21 days (range 14 to 21)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/arm.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (9 of 9 have at least one CWE).
$ grep -ril 'Arm' /var/log/news | head -5
Our reporting that names Arm or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./arm.kev · 9 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2024-4610
Mali GPU Kernel Driver
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
due 2024-07-03 · CWE-416
$ cat CVE-2024-4610.txt
Description. Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-4211
Mali GPU Kernel Driver
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
due 2023-10-24 · CWE-416
$ cat CVE-2023-4211.txt
Description. Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2021-29256
Mali Graphics Processing Unit (GPU)
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
due 2023-07-28 · CWE-416
$ cat CVE-2021-29256.txt
Description. Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Required action. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- CVE-2023-26083
Mali Graphics Processing Unit (GPU)
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability
due 2023-04-28 · CWE-401
$ cat CVE-2023-26083.txt
Description. Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Required action. Apply updates per vendor instructions.
- CVE-2022-22706
Mali Graphics Processing Unit (GPU)
Arm Mali GPU Kernel Driver Unspecified Vulnerability
due 2023-04-20 · CWE-119
$ cat CVE-2022-22706.txt
Description. Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
Required action. Apply updates per vendor instructions.
- CVE-2022-38181
Mali Graphics Processing Unit (GPU)
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
due 2023-04-20 · CWE-416
$ cat CVE-2022-38181.txt
Description. Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Required action. Apply updates per vendor instructions.
- CVE-2021-27562
Trusted Firmware
Arm Trusted Firmware Out-of-Bounds Write Vulnerability
due 2021-11-17 · CWE-787
$ cat CVE-2021-27562.txt
Description. Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
Required action. Apply updates per vendor instructions.
- CVE-2021-28663
Mali Graphics Processing Unit (GPU)
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-28663.txt
Description. Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.
Required action. Apply updates per vendor instructions.
- CVE-2021-28664
Mali Graphics Processing Unit (GPU)
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
due 2021-11-17 · CWE-787
$ cat CVE-2021-28664.txt
Description. Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.
Required action. Apply updates per vendor instructions.