CVE-2021-28664: Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability

CVE-2021-28664 is an unspecified vulnerability in the Arm Mali Graphics Processing Unit (GPU) kernel driver. According to CISA, it may allow a non-privileged user to gain write access to read-only memory, obtain root privilege, corrupt memory, and modify the memory of other processes. This matters because the Mali GPU driver commonly runs with elevated kernel privileges on devices that use Arm Mali hardware; a local attacker who can reach the driver may escalate privileges and undermine process isolation on the host.

Defenders should treat this as a kernel-level memory-safety issue in a widely deployed graphics stack. Confirm exact product coverage, fixed releases, and any platform-specific notes directly against the vendor advisory before acting.

How it works

The weakness is classified as CWE-787 (out-of-bounds write). In general terms for this class, the driver fails to adequately bound or validate memory operations that a less-privileged caller can influence. An attacker with the ability to interact with the GPU kernel driver—typically from user space on a system where the Mali driver is loaded—can trigger writes outside the intended region. That can overwrite read-only mappings, corrupt kernel or process memory, and lead to privilege escalation or arbitrary modification of other processes’ memory.

Public detail on the precise trigger path and exploit mechanics for CVE-2021-28664 is limited in the provided record. Do not assume a specific IOCTL, buffer layout, or race condition; rely on the vendor advisory for technical root-cause and any proof-of-concept restrictions. The practical outcome described by CISA is clear: non-privileged write access into protected memory and potential root-level control.

Am I affected? How to find it in your systems

Arm Mali GPUs appear in many mobile devices, embedded systems, single-board computers, and some consumer or industrial platforms that ship Linux-based or Android-derived kernels with the Mali kernel driver. Inventory should focus on endpoints and images that load a Mali GPU kernel module or vendor-supplied graphics stack tied to Arm Mali hardware.

• Enumerate systems for Mali-related kernel modules, device nodes, or graphics driver packages (for example via package managers, kernel module lists, or firmware/SBOM inventories).
• Map hardware: confirm whether devices report Arm Mali GPU identifiers in system firmware, sysfs, or vendor hardware inventories.
• Compare installed driver or firmware revisions to the fixed versions listed in the Arm (or device OEM) advisory; the CVE record alone does not name version ranges, so vendor guidance is authoritative.
• For managed fleets, use MDM, EDR, or configuration-management queries that surface GPU driver versions and kernel module load state.

Telemetry signs of exploitation are not specified in the given facts. In general for local privilege-escalation and memory-corruption issues against GPU drivers, watch for unexpected kernel oopses or panics tied to the graphics driver, anomalous privilege transitions from untrusted local accounts, and sudden process memory integrity failures. Treat such signals as investigative leads only; confirm exploitation indicators against vendor and CISA updates.

How to remediate

Patch first. Apply updates per vendor instructions, as required by CISA. Obtain the fixed Mali GPU kernel driver or platform firmware/image from Arm or from your device OEM, validate the build against the advisory, and deploy through your normal kernel/driver update channel.

• Prioritize internet-facing or multi-user systems and any hosts where untrusted local code can run.
• After update, verify the new driver version is loaded and that older modules are removed from boot paths.
• Rebuild or reimage embedded and Android-derived fleets where drivers are baked into the vendor image rather than updated in place.
• For this weakness class, hardening includes keeping the attack surface small: restrict local untrusted code execution, enforce least privilege for accounts that can open GPU device interfaces, and ensure kernel integrity protections (where supported by the platform) remain enabled.

Do not rely on version numbers or patch IDs not stated in the vendor advisory.

If you can't patch immediately

Reduce exposure until the vendor update can be applied:

• Segment and limit access: isolate devices that expose Mali GPU interfaces from untrusted users and from networks where local account compromise is more likely.
• Disable or restrict the affected feature where operationally feasible—for example, unload or blacklist the Mali kernel module on systems that do not require GPU acceleration, or lock down permissions on GPU device nodes so only trusted services can open them.
• Virtual patching / WAF is generally less applicable to a local kernel driver flaw; focus instead on host controls and application allow-listing so untrusted binaries cannot reach the driver.
• Increase monitoring on candidate hosts: kernel logs for graphics-driver faults, EDR alerts for privilege escalation, and file/memory integrity monitoring on critical processes.
• Enforce strong local authentication and remove unnecessary local accounts to raise the bar for the non-privileged starting point described in the CISA summary.

These steps only defer risk; they do not replace the vendor fix.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities can lead to full host compromise and subsequent data theft, even when ransomware use is not documented for this CVE. If you have indicators of exploitation or confirm that vulnerable systems were reachable by untrusted local users, follow your incident-response process: isolate hosts, preserve volatile evidence, rotate credentials that may have been exposed from the compromised system, and assess lateral movement. You can run a free exposure scan of your email addresses against known breach data to check whether associated identities already appear in public breach corpora, then proceed with broader containment and recovery as needed.