CVE-2023-26083: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

Vulnerability summary

CVE-2023-26083 is a low (CVSS 3.3) vulnerability in Arm Mali Graphics Processing Unit (GPU). It is known to be exploited: CISA lists it, first on 07-04-2023. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.1% of scored vulnerabilities.

Timeline

1. 06-04-2023
   PublishedVulnerability first disclosed.
2. 07-04-2023
   Added to CISA KEVArm Mali GPU Kernel Driver Information Disclosure Vulnerability
3. 28-04-2023
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.