CVE-2021-28664

What it actually does

CVE-2021-28664 is a memory-corruption vulnerability in the Arm Mali GPU kernel driver affecting Bifrost, Valhall, and Midgard driver branches. An unprivileged local user or sandboxed process can obtain read/write access to memory pages that should be read-only, undermining kernel memory protections. Successful exploitation can allow privilege escalation to kernel-level control, modification of protected memory, process or sandbox escape, information disclosure, and system crash or denial of service.

Why it matters to the business

Systems using affected Arm Mali GPU drivers may allow a low-privileged attacker or malicious application to gain full control of the device. This is especially serious for Android, embedded, mobile, and edge devices where GPU drivers are exposed to application workloads. The vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation deadline of 2021-11-17, so unpatched systems should be treated as high-priority exposure even though the EPSS score is moderate and stable.

How an attack unfolds

An attacker first obtains low-privileged code execution on a device that uses an affected Arm Mali GPU kernel driver, commonly through a malicious application, compromised app process, browser-renderer compromise, or chained exploit. The attacker then interacts with the Mali GPU device interface exposed by the kernel driver, typically through GPU ioctls or memory-management operations. By abusing the flaw, the attacker causes the driver to grant writable mappings to pages that should remain read-only. With the ability to alter protected memory, the attacker can corrupt kernel data structures, bypass normal privilege boundaries, disable security controls, elevate to root or kernel privileges, or crash the system. In real-world campaigns, this type of flaw is commonly valuable as the local privilege-escalation stage after an initial code-execution foothold.

How to fix it

Apply vendor firmware, operating system, or kernel updates that include corrected Arm Mali GPU driver versions. For source-based integrations, upgrade Bifrost drivers from r0p0-r29p0 to r30p0 or later, Valhall drivers from r19p0-r29p0 to r30p0 or later, and Midgard drivers from r8p0-r30p0 to r31p0 or later. Because many devices receive Mali drivers through OEM, Android security bulletin, BSP, or firmware channels, verify the GPU driver revision in the vendor-supplied image rather than relying only on upstream Arm version labels. If immediate patching is not possible, reduce exposure by limiting untrusted application execution, enforcing SELinux/AppArmor policies, restricting permissions on Mali device nodes where operationally feasible, disabling unused GPU acceleration paths, and prioritizing replacement or isolation of devices that no longer receive security updates.

How to confirm the fix worked

Confirm that the deployed kernel, firmware, or OS build contains a fixed Mali GPU kernel driver branch: Bifrost r30p0 or later, Valhall r30p0 or later, or Midgard r31p0 or later. On Linux-based systems, inventory loaded Mali kernel modules, GPU driver package metadata, kernel build identifiers, vendor BSP release notes, and device firmware versions. Validate that access permissions for Mali device nodes are restricted to expected users or service contexts. Where available, run vendor or OEM security patch verification tools and confirm the update level includes the relevant Arm Mali GPU driver fix. For Android-derived systems, confirm the device security patch level and OEM advisory explicitly include the Mali GPU kernel driver correction, since patch level alone may not always prove a specific vendor driver was updated.

Typical attack path

1. Identify a target device running an affected Arm Mali GPU kernel driver branch.
2. Gain initial low-privileged code execution, such as through a malicious app, compromised application process, or chained browser/application exploit.
3. Open or interact with the Mali GPU device interface exposed to user space, such as the Mali character device.
4. Trigger vulnerable GPU memory-management behavior that allows write access to read-only pages.
5. Modify protected memory or kernel data structures to escalate privileges, escape a sandbox, or disable security controls.
6. Persist, access sensitive data, install additional payloads, or cause a system crash depending on attacker objectives.

How to detect it

Post-exploitation detection is difficult because successful exploitation occurs inside a kernel driver and may leave few product-specific artifacts. Review kernel logs, crash dumps, mobile-device telemetry, EDR records, and application provenance around the time of suspicious activity. Look for abnormal access to Mali GPU device nodes by untrusted or unexpected processes, repeated GPU driver ioctl activity preceding a privilege change, kernel oops or panic messages involving Mali components, SELinux/AppArmor denials related to GPU device access, and unexplained transitions from app-level privileges to root or system contexts. On Android and embedded Linux, correlate suspicious app installation or renderer compromise with subsequent root-level process execution, remount attempts, security-control tampering, or persistence creation. Because this vulnerability is known to be exploited in the wild, also hunt for broader signs of exploit chaining, including browser/app crashes followed by kernel faults, unexpected su or shell execution, altered boot or system partitions, and unsigned or unknown binaries launched after GPU-related crashes.

• /dev/mali0
• /dev/mali
• mali_kbase
• mali_kbase_ioctl
• mali_kbase_mem
• kbase_jd_submit
• kbase_mem_alloc
• kbase_mem_free
• kbase_mmu
• Arm Mali
• Mali GPU
• Unable to handle kernel paging request
• BUG: unable to handle kernel paging request
• kernel BUG
• Oops:
• Kernel panic
• segfault at
• SELinux: avc: denied
• avc: denied
• type=1400
• comm="mali"
• /vendor/lib/egl/libGLES_mali.so
• /system/lib/egl/libGLES_mali.so
• /vendor/lib64/egl/libGLES_mali.so
• /system/lib64/egl/libGLES_mali.so

What your security team should do

• Immediately identify products, device models, firmware builds, kernels, and BSPs that include Arm Mali Bifrost, Valhall, or Midgard GPU kernel drivers in the affected version ranges.
• Prioritize remediation for internet-connected, user-facing, mobile, kiosk, embedded, and edge devices that run untrusted applications or browser-rendered content.
• Apply OEM, OS, firmware, or kernel updates that include Bifrost r30p0 or later, Valhall r30p0 or later, or Midgard r31p0 or later.
• Treat unpatched affected devices as actively exploitable because the vulnerability is in CISA KEV and has documented exploitation in the wild.
• Harden interim controls by restricting untrusted app execution, tightening access to Mali device nodes, and enforcing mandatory access-control policies around GPU interfaces.
• Review endpoint, mobile-device, kernel, and crash telemetry for signs of suspicious Mali driver interaction, kernel memory faults, privilege escalation, or unexpected root-level process creation.
• Plan lifecycle replacement for devices whose vendor no longer provides GPU driver or firmware security updates.