“In 2022 Arm fixed a weakness in the r41p0 release for the Bifrost and Valhall Mali GPU kernel driver. An external researcher recently provided new information which reclassifies this weakness as a vulnerability.”
Arm patched this use-after-free on November 24, 2022 and only now gave it a CVE, after attackers started using it. The fix has existed for more than 18 months. Android phones still run unpatched drivers because the update has to pass through the phone maker and then the carrier. Some of the affected devices get no security updates at all.