HowToFixMe
● Low · CVSS 3.3 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2023-26083: Arm Mali GPU Kernel Driver Information Disclosure

⚡ At a glance
SeverityCVSS 3.1: 3.3 - Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Actively exploited?Yes, listed in CISA KEV (added 2023-04-07)
Vendor / productArm: Mali GPU Kernel Driver
AffectedMidgard r6p0–r32p0, Bifrost r0p0–r42p0, Valhall r19p0–r42p0, Avalon r41p0–r42p0
Fixed inA driver revision newer than the affected range, delivered through your device OS / Android security update. See the Arm Mali driver advisory.
Type (CWE)CWE-401 Missing Release of Memory after Effective Lifetime (information disclosure)

Exploitation status

CVE-2023-26083 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Arm Mali GPU Kernel Driver Information Disclosure Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

Update the device, not a package. This is a flaw in the Arm Mali GPU kernel driver, so the fix arrives through your phone, tablet, Chromebook, or embedded-device OS update. not through apt or winget. It is actively exploited and listed in CISA KEV (added 2023-04-07). Install the latest OS security patch that names CVE-2023-26083 and verify the Mali driver revision is newer than the affected range.

What is CVE-2023-26083?

CVE-2023-26083, disclosed on 2023-04-06, is a memory-leak information-disclosure bug in the Arm Mali GPU kernel driver. In the exact words of the advisory: a memory leak in the Mali GPU Kernel Driver across Midgard r6p0–r32p0, Bifrost r0p0–r42p0, Valhall r19p0–r42p0, and Avalon r41p0–r42p0 “allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.”

Mapped to CWE-401 (Missing Release of Memory after Effective Lifetime), the driver fails to clean up memory after a legitimate GPU operation. The leftover memory is then handed back to an unprivileged userspace process, and that memory carries fragments of kernel data, pointers and addresses that were never meant to cross the kernel boundary. No special permissions and no user interaction are required; any local app that can submit GPU work can trigger it.

This is an information-disclosure flaw, not remote code execution, not privilege escalation, and not denial of service. That is why the CVSS 3.1 base score is only 3.3 (Low): the vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: local access, low complexity, low privileges, and confidentiality-only impact with no effect on integrity or availability.

Why a 3.3 Low ended up in CISA KEV

A 3.3 score that leaks “some kernel metadata” sounds ignorable. It is not, and the reason is chaining. Modern kernels randomize their memory layout with KASLR so that an attacker who finds a separate memory-corruption bug cannot reliably predict where to aim. The metadata this driver leaks includes kernel addresses, which lets an attacker defeat that randomization. Once the layout is known, a second, more serious GPU-driver bug becomes a stable path to root.

That is exactly how it was used. CVE-2023-26083 was reported as one link in an exploit chain that delivered commercial spyware to Android phones. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-07, one day after disclosure. and the BOD 22-01 remediation due date for federal agencies was 2023-04-28. The low base score reflects what the bug does alone; the KEV listing reflects what it does in a real attack.

Am I affected?

You are affected if a device you manage uses an Arm Mali GPU running a driver in one of these branches:

In practice that covers a huge fleet of Android phones and tablets, many Chromebooks, and embedded Linux boards built on Arm SoCs. On Linux you can read the running Mali driver version from the kernel log or sysfs to compare it against the ranges above:

# Check the loaded Mali kernel driver version on a device you can shell into.
# The "r" revision printed here is what you compare to the affected ranges.
dmesg | grep -i -E 'mali|gpu'

# On many Mali builds the version is exposed in sysfs:
cat /sys/module/mali_kbase/version 2>/dev/null
cat /sys/devices/platform/*mali*/gpuinfo 2>/dev/null

On a stock Android device you usually cannot read the driver revision directly. Instead, check Settings → Security & privacy → Updates → Android security patch level and confirm it is on or after the bulletin that fixed this CVE.

How to fix CVE-2023-26083

The fix is a corrected Mali kernel driver. How you receive it depends on the device, because Arm ships the driver to SoC and OEM vendors, who in turn ship it to you in an OS update.

Android phones and tablets

  1. Open Settings → System → System update (or your OEM's update screen) and install every pending update.
  2. Confirm the Android security patch level advances to a date whose Android Security Bulletin or OEM bulletin lists CVE-2023-26083 as fixed.
  3. If your device model is past its update window and the vendor has stopped shipping patches, the device cannot be fixed in place, plan a hardware replacement for anything handling sensitive data.

Chromebooks

  1. Go to Settings → About ChromeOS → Check for updates and install the latest ChromeOS release, then restart.
  2. ChromeOS bundles the Mali driver fix into the platform image, so a current channel build carries the corrected revision automatically.

Embedded Linux and custom kernels

  1. Obtain a Mali kernel driver (mali_kbase) revision newer than the affected branch for your GPU from the Arm Mali driver advisory or your SoC vendor's BSP.
  2. Rebuild the kernel or the out-of-tree Mali module against that revision.
  3. Reflash or deploy the updated kernel, reboot, and confirm the new driver revision loads (see verification below).
Do not try to fix this with apt, dnf, winget, or a Windows cumulative update. The vulnerable code is the Mali GPU kernel driver delivered by your device platform; a generic distro package upgrade does not touch it.

Verify the fix landed

# 1. On Android: re-check the security patch level.
adb shell getprop ro.build.version.security_patch

# 2. On Linux/embedded: re-read the Mali driver revision and confirm it is
#    past the affected range for your GPU branch.
cat /sys/module/mali_kbase/version 2>/dev/null
dmesg | grep -i mali

# 3. Reboot and confirm the GPU still initializes cleanly (no fallback to an
#    older module from a stale boot partition).
dmesg | grep -i -E 'mali|gpu' | tail -n 20

If you can't patch immediately

Arm's advisory does not document a configuration workaround: the driver code itself has to be corrected. Because exploitation requires a local process that can submit GPU work, the only meaningful interim controls reduce what untrusted code runs on the device:

None of these remove the flaw. The corrected Mali driver is the only real fix.

Frequently asked questions

Is CVE-2023-26083 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-07. It was reported as part of an exploit chain that delivered commercial spyware to Android devices, where the leaked kernel addresses helped defeat KASLR and stabilize a follow-on privilege-escalation exploit.

Which devices and driver branches are affected?

Any device with an Arm Mali GPU on an affected driver branch: Midgard r6p0–r32p0, Bifrost r0p0–r42p0, Valhall r19p0–r42p0, and Avalon r41p0–r42p0. That spans a large range of Android phones and tablets, many Chromebooks, and embedded Linux devices.

How do I actually fix it, there's no apt package for this?

Correct. The fix is in the Mali GPU kernel driver, delivered by your device or platform vendor. On Android, install the OS security update that lists CVE-2023-26083. On embedded Linux or ChromeOS, move to a Mali driver revision newer than the affected range and reflash the kernel.

If it's only a 3.3 Low, can I deprioritize it?

Not safely. Alone it only leaks kernel metadata to a local process, hence the low score. But it defeats KASLR and was used in a real spyware chain, which is why it sits in CISA KEV. Patch it on the same urgency as the chain it enables.

References

Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related guides worth a look while you sort this one out:

People also ask

Is CVE-2023-26083 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-07. It was reported as part of an exploit chain that delivered commercial spyware to Android devices, where the leaked kernel addresses helped defeat KASLR and stabilize a follow-on privilege-escalation exploit.

Which devices and driver branches are affected?

Any device with an Arm Mali GPU on an affected driver branch: Midgard r6p0–r32p0, Bifrost r0p0–r42p0, Valhall r19p0–r42p0, and Avalon r41p0–r42p0. That spans a large range of Android phones and tablets, many Chromebooks, and embedded Linux devices.

How do I actually fix it. there's no apt package for this?

Correct. The fix is in the Mali GPU kernel driver, delivered by your device or platform vendor. On Android, install the OS security update that lists CVE-2023-26083. On embedded Linux or ChromeOS, move to a Mali driver revision newer than the affected range and reflash the kernel.

If it's only a 3.3 Low, can I deprioritize it?

Not safely. Alone it only leaks kernel metadata to a local process, hence the low score. But it defeats KASLR and was used in a real spyware chain, which is why it sits in CISA KEV. Patch it on the same urgency as the chain it enables.