CVE-2023-26083: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

CVE-2023-26083 is an information disclosure flaw in the Arm Mali GPU Kernel Driver. A non-privileged user can issue valid GPU processing operations that cause the driver to expose sensitive kernel metadata. Because the GPU driver sits close to the kernel and is present on many mobile, embedded, and some desktop systems that use Arm Mali graphics hardware, successful abuse can give an attacker useful internal details that aid further privilege escalation or system compromise. Defenders should treat this as a local information-leak risk that requires inventory and timely patching.

How it works

The vulnerability is classified under CWE-401. In practice, the Arm Mali GPU Kernel Driver fails to properly handle certain resources or state during legitimate GPU operations. A local, unprivileged process can submit ordinary GPU work that triggers the driver to return or leave behind kernel metadata that should remain inaccessible. The attacker does not need to craft malformed packets or exploit a remote service; the operations themselves are valid from the GPU’s perspective. The result is disclosure of sensitive kernel information rather than direct code execution. Exact trigger conditions and the precise metadata that leaks must be confirmed against the vendor advisory; public detail beyond the CISA summary is limited.

Am I affected? How to find it in your systems

Arm Mali GPUs appear in a wide range of Android devices, certain Linux-based embedded platforms, and some Arm-based servers or single-board computers. The vulnerable component is the kernel driver that mediates access to the Mali GPU.

• Inventory devices and hosts that contain an Arm Mali GPU. On Linux systems check loaded modules and device nodes associated with Mali; on Android examine kernel version strings and GPU driver packages.
• Identify the exact driver version and build in use. Compare it against the fixed versions listed in the Arm or device-vendor advisory; do not rely on generic version ranges.
• Look for non-privileged processes that issue frequent or unusual GPU operations, especially from untrusted apps or containers that have access to the GPU device node.
• Review kernel logs and any GPU-related telemetry for unexpected errors, memory-related warnings, or anomalous metadata exposure events. Absence of such logs does not prove safety; the leak may be silent.

If you cannot determine the driver version, treat the system as potentially affected until the vendor advisory confirms otherwise.

How to remediate

Apply the vendor-supplied updates for the Arm Mali GPU Kernel Driver exactly as instructed by Arm or by the device manufacturer that ships the driver. CISA’s required action is simply to apply those updates. After patching, reboot if required so the new driver is loaded, then verify the running version matches the fixed release.

As additional hardening for this class of kernel-driver information disclosure:

• Restrict access to the GPU device node so that only trusted processes can open it.
• Run untrusted workloads in environments that do not expose the raw GPU interface.
• Keep the rest of the kernel and user-space graphics stack current so that related memory-management issues are also addressed.

If you can't patch immediately

Until the official update can be installed, reduce the attack surface with compensating controls:

• Segment systems that contain the Mali GPU so that untrusted local users or containers cannot reach the GPU device.
• Disable or unload the Mali kernel driver on hosts that do not require GPU acceleration; confirm functionality impact first.
• Apply virtual-patching rules or host-based controls that limit which processes may open the GPU device node.
• Increase monitoring of GPU-related syscalls, device opens, and kernel log messages for signs of probing.
• Enforce least privilege so that ordinary user accounts cannot submit GPU work.

These steps lower risk but do not eliminate the underlying flaw; schedule the vendor update as soon as possible.

If your data may have been exposed

Information-disclosure vulnerabilities of this type can supply an attacker with kernel details that facilitate later privilege escalation or lateral movement. Known ransomware use of CVE-2023-26083 is not documented, yet any successful local compromise can still lead to broader data exposure. If you suspect the driver was abused, examine systems for unauthorized privilege changes, unexpected processes, and signs of further exploitation. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether any associated credentials have already appeared in public leaks.