⚠ Actively exploited
Added to CISA KEV on 2023-04-07. Federal agencies required to patch by 2023-04-28. Required action: Apply updates per vendor instructions..

CVE-2023-26083 — Missing Release of Memory after Effective Lifetime in ARM 5TH GEN GPU Architecture Kernel Driver

CWE-401 — Missing Release of Memory after Effective Lifetime8 documents8 sources
Severity
3.3LOWNVD
EPSS
5.2%
top 10.03%
CISA KEV
KEV
Added 2023-04-07
Due 2023-04-28
Exploit
Exploited in wild
Active exploitation observed
Affected products
6
ARM 5TH GEN GPU Architecture Kernel DriverARM Bifrost GPU Kernel DriverARM Valhall GPU Kernel Driver+3 more
Timeline
PublishedApr 6
KEV addedApr 7
KEV dueApr 28
Latest updateJul 10
CISA Required Action: Apply updates per vendor instructions.

Description

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages6 packages

▶NVDarm/bifrost_gpu_kernel_driverr0p0 — r43p0
▶NVDarm/valhall_gpu_kernel_driverr19p0 — r43p0
▶NVDarm/midgard_gpu_kernel_driverr6p0 — r32p0

🔴Vulnerability Details

3
Project0
Analyzing a Modern In-the-wild Android Exploit - Project Zero↗2023-09-01
▶
GHSA
GHSA-xfv3-jp8h-q7v6: Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all version↗2023-04-06
▶
VulnCheck
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability↗2023
▶

📋Vendor Advisories

3
Android
CVE-2023-26083: Mali↗2023-07-01
▶
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2023-26083↗2023-04-27
▶
CISA
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability↗2023-04-07
▶

📄Research Papers

1
arXiv
Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritization↗2025-07-10
▶