CVE-2023-26083: Arm Mali GPU Kernel Driver memory leak exposes kernel metadata

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing confirms known exploitation, but the CVSS score is only 3.3 and the flaw is limited to local information disclosure.

What it is

The Arm Mali GPU kernel driver has a memory leak (CWE-401) across Midgard r6p0-r32p0, Bifrost r0p0-r42p0, Valhall r19p0-r42p0, and Avalon r41p0-r42p0. A non-privileged user can perform valid GPU operations that leak sensitive kernel metadata. The flaw matters because it gives a low-privileged local process a path to kernel information that can aid further attacks.

Impact

An attacker gains disclosure of sensitive kernel metadata, which can be used to defeat kernel address space layout randomization and prepare privilege escalation or sandbox escape. No code execution or data modification is provided by this flaw alone.

Attack surface

Reached locally by a non-privileged user issuing valid GPU processing operations through the Mali kernel driver; no user interaction is required and the CVSS vector is AV:L/PR:L/UI:N.

Exploitation

CVE-2023-26083 is listed in CISA KEV with a 2023-04-28 remediation due date, indicating known exploitation, while EPSS 30-day probability is low at 0.01218 (67th percentile). No ransomware campaign use is documented.

What to do

• Apply the Arm Mali GPU kernel driver updates referenced in the Arm Security Center advisory for the affected Midgard, Bifrost, Valhall, and Avalon branches.
• If patching cannot be completed immediately, restrict local access to GPU device nodes to trusted users and processes.
• Track the CISA KEV due date of 2023-04-28 and confirm remediation across all affected devices, including Android and embedded products using Mali GPUs.
• Monitor vendor advisories for downstream Android and SoC vendor patches, since the Arm driver fix must be delivered through device firmware updates.

Detection

• Monitor for unusual local processes opening or issuing ioctls to /dev/mali0 or equivalent Mali GPU device nodes.
• Alert on repeated GPU driver allocation or mapping failures that could indicate memory leak probing.
• Correlate kernel metadata disclosure attempts with subsequent privilege escalation or sandbox escape activity on the same host.
• Audit device fleets for unpatched Mali GPU driver versions against the affected r6p0-r32p0, r0p0-r42p0, r19p0-r42p0, and r41p0-r42p0 ranges.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.