Security readout for executives and security teams
Plain-English summary
This is a local information-disclosure issue in Arm Mali GPU kernel drivers. A normal user on an affected system can perform valid GPU work that may expose sensitive kernel metadata. The technical severity is low, but CISA KEV listing means known exploitation has been reported, raising operational priority.
Executive priority
Treat as a time-bound remediation item for affected assets because it is in CISA KEV, despite low CVSS severity. Prioritize internet-managed device fleets, shared systems, and environments where local compromise could support broader attack chains.
Technical view
CVE-2023-26083 is a CWE-401 memory leak in Mali GPU Kernel Driver families Midgard, Bifrost, Valhall, and Avalon across the published version ranges. It requires local access with low privileges, no user interaction, and affects confidentiality only, per CVSS 3.1 score 3.3.
Likely exposure
Exposure is limited to systems running affected Arm Mali GPU kernel driver versions: Midgard r6p0-r32p0, Bifrost r0p0-r42p0, Valhall r19p0-r42p0, or Avalon r41p0-r42p0. The bundle does not identify specific OEM products or device models.
Exploitation context
CISA KEV inclusion supports known exploitation. The provided sources do not include exploit details, targeting patterns, or weaponization guidance. Attackers need local low-privileged access, so this is most concerning on shared, compromised, or hard-to-patch endpoint and device fleets.
Researcher notes
The key gap is product mapping: the CVE record lists driver families and ranges, not specific devices. Validation should focus on kernel driver provenance and versioning. Do not infer remote exploitability; the CVSS vector is local, low privilege, no interaction, confidentiality-only.
Mitigation direction
- Check Arm and device-vendor guidance for fixed Mali GPU kernel driver packages.
- Apply OEM firmware, kernel, or driver updates covering affected Mali driver ranges.
- Prioritize remediation where KEV requirements or regulated environments apply.
- Reduce untrusted local user access on affected systems until updates are confirmed.
- Track vendor advisories because the bundle does not name a standalone workaround.
Validation and detection
- Inventory systems using Mali GPU kernel drivers and record driver family and release version.
- Compare versions against the affected Midgard, Bifrost, Valhall, and Avalon ranges.
- Confirm whether updates map to Arm or OEM guidance for CVE-2023-26083.
- Verify patched assets no longer run a driver version in the vulnerable ranges.
- Document unknown OEM mappings separately for vendor follow-up.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-26083 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N1.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesCVE reference
- https://www.cybersecurity-help.cz/vdb/SB2023033049CVE reference
- https://www.cybersecurity-help.cz/vulnerabilities/74210/CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26083CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.