Arm Mali GPU Kernel Driver Memory Corruption and Local Privilege Escalation (CVE-2021-28664)
Executive & SecOps Summary
SECOPS ASSESSMENTDevices utilizing Arm Mali GPU kernel drivers based on Bifrost (r0p0 through r29p0), Valhall (r19p0 through r29p0), and Midgard (r8p0 through r30p0) architectures
An unprivileged local attacker can gain read/write access to read-only memory pages, leading to kernel memory corruption, local privilege escalation (LPE) to root, or a complete Denial of Service (DoS)
Immediately apply the official security patches and upgrade to driver versions r30p0 (Bifrost/Valhall) or r31p0 (Midgard) or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, integrate the patched driver source code from Arm into your kernel build pipeline. Follow these steps to update and rebuild the driver:
# Navigate to your kernel's Mali GPU driver directory
cd drivers/gpu/arm/midgard
# Fetch and checkout the patched release branch (r30p0/r31p0 or later)
git fetch origin
git checkout tags/r30p0 -b patch_branch
# Rebuild the kernel image with the updated driver
make ARCH=arm64 CROSS_COMPILE=aarch64-linux-android- defconfig
make ARCH=arm64 CROSS_COMPILE=aarch64-linux-android- -j$(nproc)2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the Mali GPU device node to prevent unprivileged local processes from interacting with the vulnerable driver.
# Restrict permissions on the Mali GPU device node
chmod 600 /dev/mali0
chown root:root /dev/mali0
# Persist the restriction across reboots using a udev rule
echo 'KERNEL=="mali0", MODE="0600", OWNER="root", GROUP="root"' | sudo tee /etc/udev/rules.d/99-mali-hardening.rules
sudo udevadm control --reload-rules && sudo udevadm trigger3. Log Audit & IoC Verification Commands
Use the following script to verify the active Mali driver version and inspect system logs for potential exploitation attempts or related kernel crashes.
#!/bin/bash
echo '[+] Checking Arm Mali GPU Driver Version...'
if [ -f /sys/module/mali/version ]; then
cat /sys/module/mali/version
elif [ -f /sys/module/mali_kbase/version ]; then
cat /sys/module/mali_kbase/version
else
echo '[-] Mali GPU driver module version file not found.'
fi
echo '[+] Auditing dmesg for memory corruption or page faults...'
# Search for anomalies related to Mali driver and page translation faults
dmesg | grep -Ei 'mali|page fault|unable to handle kernel paging request|address translation fault'Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-28664) is a critical memory corruption flaw (CWE-787) residing in the memory management subsystem of the Arm Mali GPU kernel driver. The root cause stems from improper validation and handling of memory page permissions when an unprivileged user requests memory mapping or IOCTL operations. The driver incorrectly allows write access to memory pages that should be strictly marked as read-only, enabling user-space processes to bypass kernel-level memory protections.
2. Exploitation Mechanics & Attack Scenario
An attacker with local access (e.g., via an unprivileged malicious application or local shell) initiates the exploit by opening the /dev/mali0 device node. By crafting specific GPU memory allocation requests, the attacker manipulates the driver's page table entry (PTE) configuration. This forces the driver to map sensitive kernel-controlled or read-only physical pages with write permissions in the attacker's virtual address space. Once write access is achieved, the attacker overwrites critical kernel structures or function pointers to hijack execution flow and elevate privileges to root (UID 0).
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, it represents a highly practical and actively exploited threat vector. Successful exploitation on mobile, IoT, or embedded systems allows attackers to bypass application sandboxes, compromise sensitive user data, and establish persistent control over the device. It also poses a severe risk of system instability, leading to kernel panics and operational downtime.
Official Vendor Advisories & References
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.
Frequently Asked SecOps Questions (CVE-2021-28664)
FAQQ1. How critical is CVE-2021-28664 and is it actively exploited in the wild?
CVE-2021-28664 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 5.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-28664?
Primary impacted vendors include arm across mali gpu driver, bifrost, valhall, midgard. Scope summary: Arm Mali GPU Kernel Driver: - Bifrost: r0p0 through r29p0 (fixed in r30p0) - Valhall: r19p0 through r29p0 (fixed in r30p0) - Midgard: r8p0 through r30p0 (fixed in r31p0)
Q3. What temporary mitigations or workarounds exist for CVE-2021-28664 before patching?
[Mitigation] Immediately apply the official security patches and upgrade to driver versions r30p0 (Bifrost/Valhall) or r31p0 (Midgard) or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-28664
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (arm)
View Category →Google Chrome Skia Graphics Engine Out-of-bounds Write Vulnerability (CVE-2026-3909) Technical Advisory
[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Google Chrome V8 Out-of-bounds Write Remote Code Execution Advisory (CVE-2026-87491)
[Affected Scope] Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers
Linux Kernel Netfilter Bridge ebt_snat ARP Rewrite Vulnerability (CVE-2026-53266)
[Affected Scope] Linux systems utilizing ebtables SNAT targets within bridge netfilter configurations.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.