CVE-2023-4211: Arm Mali GPU Kernel Driver use-after-free via improper GPU memory handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is listed in CISA KEV with confirmed in-the-wild exploitation, though the CVSS score is only 5.5 and the impact is limited to confidentiality.

What it is

The Arm Mali GPU kernel driver mishandles GPU memory operations, allowing a use-after-free (CWE-416) in which freed memory can be accessed again. A local non-privileged user can trigger it, and the flaw affects the Midgard, Bifrost, Valhall and 5th Gen GPU architecture kernel drivers. It matters because freed kernel memory exposure can leak sensitive data and is a common building block for privilege escalation in GPU drivers.

Impact

An attacker gains read access to already freed memory, which can disclose sensitive kernel or process data (CVSS confidentiality impact is High). The record shows no integrity or availability impact, so code execution or privilege escalation is not established by the supplied facts.

Attack surface

Reached locally: the vector is AV:L with low attack complexity, low privileges required and no user interaction (PR:L/UI:N). Any local unprivileged process able to issue GPU memory operations through the Mali driver can attempt it; no remote or network path is described.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-03 with a remediation due date of 2023-10-24, indicating known exploitation in the wild. EPSS is low (0.011, ~64th percentile) and no ransomware campaign use is documented.

What to do

• Apply the vendor's Mali GPU driver fix per Arm Security Center guidance as the first action.
• If no patch can be applied, follow CISA's required action: apply vendor mitigations or discontinue use of the affected product.
• Restrict local access to systems using affected Mali GPUs so untrusted users cannot run code that issues GPU memory operations.
• Track the CISA KEV due date (2023-10-24) and confirm remediation status for all affected driver variants (Midgard, Bifrost, Valhall, 5th Gen).

Detection

• Monitor for crashes or anomalous behavior in the Mali GPU kernel driver (kernel oops, driver fault logs) that could indicate use-after-free triggering.
• Hunt for local processes making unusual or repeated GPU memory allocation/free sequences, especially from non-privileged users.
• Correlate local exploitation attempts with subsequent suspicious activity such as kernel memory disclosure or privilege escalation attempts.
• Verify driver versions against Arm's advisory to identify unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.