Arm Mali GPU Kernel Driver Use-After-Free Privilege Escalation Vulnerability (CVE-2021-28663) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTArm Mali GPU Midgard (r4p0 to r30p0), Bifrost (r0p0 to r28p0), and Valhall (r19p0 to r28p0) kernel drivers
A local attacker can exploit improper GPU memory operations to trigger a Use-After-Free (UAF) condition, leading to local privilege escalation (LPE) and information disclosure
Upgrade the Arm Mali GPU kernel driver to version r29p0 or later, or apply the latest security patches provided by your device OEM
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, integrate and compile the Arm Mali GPU kernel driver version r29p0 or later into your kernel build. Below is an example of how to fetch and build the updated driver source:
# Clone the official Arm Mali GPU driver repository and checkout the patched version
git clone https://github.com/ARM-software/mali-ddk-kernel-driver.git
cd mali-ddk-kernel-driver
git checkout r29p0
# Set up the cross-compilation environment and build the kernel module
export ARCH=arm64
export CROSS_COMPILE=aarch64-linux-gnu-
make -C /lib/modules/$(uname -r)/build M=$(pwd) modules2. Temporary Workaround & Hardening Configuration
If immediate kernel patching is not feasible, restrict access to the Mali GPU device nodes (/dev/mali*) to prevent untrusted local applications from interacting with the vulnerable driver.
# Restrict permissions on the Mali GPU device nodes
sudo chmod 600 /dev/mali*
sudo chown root:root /dev/mali*
# Persist the restriction across reboots using a udev rule
echo 'KERNEL=="mali*", MODE="0600", OWNER="root", GROUP="root"' | sudo tee /etc/udev/rules.d/99-mali-security.rules
sudo udevadm control --reload-rules && sudo udevadm trigger3. Log Audit & IoC Verification Commands
Use the following commands to verify the active Mali GPU driver version and inspect kernel logs for potential exploitation attempts or memory corruption events.
# Check the currently loaded Mali GPU driver version
cat /sys/module/mali/version 2>/dev/null || modinfo mali | grep -i version
# Audit kernel logs for Use-After-Free indicators or GPU MMU faults
sudo dmesg | grep -Ei 'mali|uaf|use-after-free|page fault|mmu fault'Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-28663) is a critical Use-After-Free (UAF) flaw in the Arm Mali GPU kernel driver, stemming from the improper handling of GPU memory operations. The root cause lies in the driver's failure to correctly manage reference counts or validate memory mappings during allocation and deallocation sequences, allowing a freed memory address to remain accessible.
2. Exploitation Mechanics & Attack Scenario
An attacker with local execution privileges can craft malicious API calls to the GPU driver to trigger race conditions or improper reference counting during GPU memory mapping. Once the kernel frees a specific memory page, the driver fails to invalidate the corresponding GPU MMU mappings. The attacker can then reclaim this freed memory space with controlled payloads, manipulating kernel structures to gain arbitrary read/write capabilities and escalate privileges to root.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA KEV catalog, CVE-2021-28663 has been actively exploited in the wild. It poses a severe threat to mobile devices, embedded systems, and IoT infrastructure utilizing Arm Mali GPUs. Successful exploitation bypasses application sandboxes, allowing attackers to compromise the entire operating system, steal sensitive enterprise data, and establish persistent unauthorized access.
Official Vendor Advisories & References
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.
Frequently Asked SecOps Questions (CVE-2021-28663)
FAQQ1. How critical is CVE-2021-28663 and is it actively exploited in the wild?
CVE-2021-28663 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 12.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-28663?
Primary impacted vendors include arm across mali_gpu_kernel_driver. Scope summary: Arm Mali GPU Kernel Driver: - Midgard: r4p0 through r30p0 - Bifrost: r0p0 through r28p0 - Valhall: r19p0 through r28p0 (All versions prior to r29p0 are vulnerable)
Q3. What temporary mitigations or workarounds exist for CVE-2021-28663 before patching?
[Mitigation] Upgrade the Arm Mali GPU kernel driver to version r29p0 or later, or apply the latest security patches provided by your device OEM Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-28663
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (arm)
View Category →Google Chrome Dawn Use-After-Free Vulnerability (CVE-2026-5281) Technical Advisory
[Affected Scope] Google Chrome versions prior to 146.0.7680.178
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.