---
title: "Arm Mali GPU CVE-2023-4211: Exploited Kernel Driver UAF"
url: https://erroneo.us/security/briefs/arm-mali-gpu-cve-2023-4211-use-after-free/
description: "Mali GPU kernel driver use-after-free used in targeted Android attacks. Fixed in Arm r43p0 and Android patch level 2023-10-05. Check old and Midgard devices."
type: security-brief
section: "Security Digest"
date_published: 2023-10-02
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-4211"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Arm Mali GPU CVE-2023-4211: Exploited Kernel Driver UAF

**Verdict: Check exposure.** Patched in Android in October 2023, so current phones are fine; what remains are unpatched or abandoned Mali devices, and Midgard-based hardware that never got a fix.

- **Who must act:** Owners of Android or embedded Linux devices with Arm Mali GPUs on security patch levels before 2023-10-05, and of any device with an older Midgard (Mali-T series) GPU.
- **Who can relax:** Fleets whose Mali-based devices are on a supported model with a security patch level of 2023-10-05 or later, and devices without Mali GPUs.
- **Affected:** Midgard GPU kernel driver r12p0 through r32p0 (no fix); Bifrost GPU kernel driver r0p0 through r42p0; Valhall GPU kernel driver r19p0 through r42p0; Arm 5th Gen GPU architecture kernel driver r41p0 through r42p0; Android devices with Mali GPUs on security patch levels before 2023-10-05
- **Fixed:** Bifrost, Valhall and Arm 5th Gen kernel drivers r43p0 (released Mar 24, 2023); Android security patch level 2023-10-05 or later
- **CVEs:** CVE-2023-4211
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull the security patch level of every managed Android device and list Mali-based devices below 2023-10-05.
2. Block corporate access from devices below that patch level until they update.
3. Retire devices that no longer receive security updates, and any device with a Midgard (Mali-T series) GPU, which has no fix.
4. For embedded Linux products with Mali GPUs, ask the SoC or board vendor to confirm the kernel driver is r43p0 or later.
5. Keep the minimum allowed patch level rolling forward; this bug sat fixed in Arm's driver for months before phones received it.

### How to check if you are affected

- Check the patch level with adb shell getprop ro.build.version.security_patch, and the GPU with adb shell getprop ro.hardware.egl (typically mali on Mali devices).
- Arm and Google published no indicators of compromise; a current patch level is the main signal.
- For high-risk users whose devices lagged on patches in 2023, arrange a professional mobile forensic review instead of relying on on-device checks.

## What happened

On October 2, 2023, Arm disclosed CVE-2023-4211, a use-after-free in its Mali GPU kernel driver. Arm said the flaw "may be under limited, targeted exploitation." The same day, Google's [Android Security Bulletin for October 2023](https://source.android.com/docs/security/bulletin/2023-10-01) noted "indications" of limited, targeted exploitation. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211) on October 3, with an October 24 deadline. Maddie Stone of Google's Threat Analysis Group and Jann Horn of Google Project Zero reported it.

Google's [root-cause analysis](https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2023/CVE-2023-4211.html) traces the flaw to the driver's handling of a "tracking page" memory mapping. Before r43, a process could split that mapping, fork, and race the two processes. The driver then did bookkeeping on another process's memory descriptor after it had been freed. Any app that can open `/dev/mali0` can reach the bug. On Android that includes an ordinary installed app, or code already running inside a compromised one. Google had the exploit sample but has not named the attacker. [Help Net Security](https://www.helpnetsecurity.com/2023/10/03/cve-2023-4211/) notes that two earlier Mali zero-days were used to deliver spyware from the commercial vendor Variston.

## Who is affected

Per Arm's [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-4211):

- Bifrost r0p0–r42p0, Valhall r19p0–r42p0 and Arm 5th Gen r41p0–r42p0 are affected. All are fixed in r43p0, which [BleepingComputer](https://www.bleepingcomputer.com/news/security/arm-warns-of-mali-gpu-flaws-likely-exploited-in-targeted-attacks/) says Arm released on March 24, 2023.
- Midgard r12p0–r32p0 is affected with no fixed release. Arm told Midgard customers to contact Arm support.

Mali GPUs ship in many Android phones and tablets and in other Arm-based devices. BleepingComputer listed Mali-G77 phones such as the Samsung Galaxy S20 and S20 FE, Xiaomi Redmi K30 and K40, Motorola Edge 40 and OnePlus Nord 2 as examples. On Android, the fix is in security patch level 2023-10-05 and later.

## Do you really need to act?

For a supported, updated phone, no. Three years of monthly patches cover it. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-4211) scores it CVSS 3.1 5.5 because it is local, but Android rates it High. In practice, Mali driver bugs have served as the kernel step in spyware chains.

The bug also shows the gap. Arm's fixed driver was out in March 2023, yet phones got it only with the October patch level. Devices that stopped receiving updates before then are still exposed: out-of-support models, cheap tablets, TV boxes and rugged or kiosk devices. Midgard-based hardware never got a fix at all.

## What to do now

1. Pull patch levels from your MDM, or per device run `adb shell getprop ro.build.version.security_patch`. Flag anything below 2023-10-05.
2. Find Mali devices. `adb shell getprop ro.hardware.egl` typically returns `mali`, and `adb shell dumpsys SurfaceFlinger | grep -i GLES` shows the GPU model and driver string.
3. Block corporate access from devices below 2023-10-05 until they update. Retire models that no longer get updates.
4. Retire devices with Midgard (Mali-T series) GPUs. No fix exists.
5. For embedded Linux products with Mali GPUs, ask the SoC or board vendor to confirm the kernel driver is r43p0 or later.

## How to tell if you were hit

Arm and Google published no indicators of compromise. Exploitation was targeted, and the bug alone needs code already running on the device, so there is little to see on the network. A current patch level is the main check. For high-risk users whose phones were unpatched in 2023, such as executives, journalists and activists, arrange a professional mobile forensic review rather than relying on on-device checks.

## Timeline

- Mar 24, 2023 — Arm releases Mali driver r43p0, which fixes the bug for Bifrost, Valhall and 5th Gen GPUs.
- Oct 2, 2023 — Arm discloses CVE-2023-4211 and reports possible targeted exploitation. The Android Security Bulletin ships the fix at patch level 2023-10-05.
- Oct 3, 2023 — CISA adds CVE-2023-4211 to KEV.
- Oct 24, 2023 — CISA's remediation deadline for federal agencies.

## Sources

1. [CVE record — CVE-2023-4211 (Arm)](https://www.cve.org/CVERecord?id=CVE-2023-4211)
2. [Android — Android Security Bulletin, October 2023](https://source.android.com/docs/security/bulletin/2023-10-01)
3. [Google Project Zero — CVE-2023-4211: Use-after-Free in ARM Mali GPU Driver](https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2023/CVE-2023-4211.html)
4. [NVD — CVE-2023-4211](https://nvd.nist.gov/vuln/detail/CVE-2023-4211)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-4211](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211)
6. [BleepingComputer — Arm warns of Mali GPU flaws likely exploited in targeted attacks](https://www.bleepingcomputer.com/news/security/arm-warns-of-mali-gpu-flaws-likely-exploited-in-targeted-attacks/)
7. [Help Net Security — Zero-day in Arm GPU drivers exploited in targeted attacks (CVE-2023-4211)](https://www.helpnetsecurity.com/2023/10/03/cve-2023-4211/)

---
Source page: https://erroneo.us/security/briefs/arm-mali-gpu-cve-2023-4211-use-after-free/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt