{"identifier":"CVE-2023-26083","cve":{"id":"CVE-2023-26083","description":"Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.","published":"2023-04-06T16:15:07.843000+00:00","modified":"2026-06-17T05:42:38.457000+00:00","status":"Analyzed","score":3.3,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r41p0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"r43p0"},{"criteria":"cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r0p0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"r43p0"},{"criteria":"cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r6p0","versionStartExcluding":"","versionEndIncluding":"r32p0","versionEndExcluding":""},{"criteria":"cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r19p0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"r43p0"}],"weaknesses":["CWE-401"],"references":[{"url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://www.cybersecurity-help.cz/vdb/SB2023033049","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.cybersecurity-help.cz/vulnerabilities/74210/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.cybersecurity-help.cz/vdb/SB2023033049","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.cybersecurity-help.cz/vulnerabilities/74210/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26083","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}],"kev":{"cveID":"CVE-2023-26083","vendorProject":"Arm","product":"Mali Graphics Processing Unit (GPU)","vulnerabilityName":"Arm Mali GPU Kernel Driver Information Disclosure Vulnerability","dateAdded":"2023-04-07","shortDescription":"Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-04-28","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities;  https://nvd.nist.gov/vuln/detail/CVE-2023-26083","cwes":["CWE-401"]},"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-01-19T17:57:15.442432Z","id":"CVE-2023-26083","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r41p0","versionEndExcluding":"r43p0","matchCriteriaId":"574A1E71-2B1E-48D4-AA93-974B4E34C64F"},{"vulnerable":true,"criteria":"cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r0p0","versionEndExcluding":"r43p0","matchCriteriaId":"C7205027-9AE7-4095-B0A7-B1ECA71ACCAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r6p0","versionEndIncluding":"r32p0","matchCriteriaId":"ABA04388-28FC-4F87-85F4-B7FD0B553611"},{"vulnerable":true,"criteria":"cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"r19p0","versionEndExcluding":"r43p0","matchCriteriaId":"38BF4620-6A5C-4034-8D17-BC1AC5F8C711"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T16:17:13.878842+00:00","exploited":true,"kev_stale":false,"products":["arm / 5th gen gpu architecture kernel driver","arm / bifrost gpu kernel driver","arm / midgard gpu kernel driver","arm / valhall gpu kernel driver"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.01218,"percentile":0.68469,"date":"2026-10-27","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"developer.arm.com","source_url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","investigate_url":"https://investigate.aeglixmind.com/#developer.arm.com"},{"domain":"www.cybersecurity-help.cz","source_url":"https://www.cybersecurity-help.cz/vdb/SB2023033049","investigate_url":"https://investigate.aeglixmind.com/#www.cybersecurity-help.cz"},{"domain":"www.cisa.gov","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26083","investigate_url":"https://investigate.aeglixmind.com/#www.cisa.gov"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2023-26083","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2023-26083","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2023-26083","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}