{"id":"CVE-2021-28663","kind":"vulnerability","aliases":["CVE-2021-28663"],"related":[],"title":"Arm Mali Graphics Processing Unit (GPU): Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability","description":"Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.\n\nCISA required action: Apply updates per vendor instructions.","summary":"The Arm Mali GPU kernel driver has a use-after-free bug that lets a local, non-privileged user manipulate GPU memory. Successful exploitation gives root privileges and can leak information.","severity":"critical","cvss":9.0,"epss":0.12084,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Arm Mali Graphics Processing Unit (GPU)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","arm-mali","embedded","exploited","infrastructure","linux"],"not_affected_if":["driver-patched","no-mali-gpu"],"how_to_check":null,"fix":"Apply the vendor updates for the Arm Mali GPU kernel driver per Arm's instructions; the specific fixed driver version is unknown from these sources.","status":"open","published_at":"2021-05-10T15:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:46+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:33:46Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates for the Arm Mali GPU kernel driver per Arm's instructions; the specific fixed driver version is unknown from these sources.","reach":"local","impact":"high","summary":"The Arm Mali GPU kernel driver has a use-after-free bug that lets a local, non-privileged user manipulate GPU memory. Successful exploitation gives root privileges and can leak information.","category":"infrastructure","who_cares":["android","arm-mali","linux","embedded"],"confidence":0.7,"needs_auth":"yes","worst_case":"local unprivileged user gains root and reads kernel information","analyst_note":"Find the fixed Mali driver versions and affected device list in Arm's security bulletin for CVE-2021-28663 and check the CISA KEV entry for the required action deadline.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-mali-gpu","driver-patched"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2893,"output_tokens":364,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the fixed Mali driver versions and affected device list in Arm's security bulletin for CVE-2021-28663 and check the CISA KEV entry for the required action deadline.","search":"'-2021':19A,22A '-28663':20A,23A 'action':110C 'allow':88C 'and/or':105C 'android':30B 'appli':111C 'arm':1A,7A,24A,32B,39B,71C 'arm-mali':31B 'bug':50B 'cisa':108C 'contain':79C 'cve':18A,21A 'disclos':106C 'driver':43B,78C 'embed':34B 'exploit':35B,63B 'free':16A,49B,84C 'gain':102C 'give':64B 'gpu':6A,12A,29A,41B,60B,76C,99C 'graphic':3A,9A,73C 'graphics':26A 'improp':96C 'inform':70B,107C 'infrastructur':36B 'instruct':115C 'kernel':42B,77C 'leak':69B 'let':52B 'linux':37B 'local':54B 'make':95C 'mali':2A,8A,25A,33B,40B,72C 'manipul':59B 'may':87C 'memori':61B,100C 'non':56B,91C 'non-privileg':55B,90C 'oper':97C 'per':113C 'privileg':57B,66B,92C,104C 'process':4A,10A,74C 'processing':27A 'requir':109C 'root':65B,103C 'success':62B 'unit':5A,11A,28A,75C 'updat':112C 'use':14A,47B,82C 'use-after-fre':13A,46B,81C 'user':58B,93C 'vendor':114C 'vulner':17A,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-10T15:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-28663","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-28663","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2021-28663","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28663","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-28663","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28663","severity":null,"published_at":"2021-05-10T15:15:07+00:00","modified_at":"2026-06-17T03:46:43+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}