What is the fix for CVE-2022-22706?

Apply the vendor updates per Arm's advisory for the Mali GPU kernel driver; the affected and fixed driver versions are unknown from the sources. CISA's KEV entry requires applying updates per vendor instructions.

Who is not affected by CVE-2022-22706?

Not affected if: no-mali-gpu-driver.

Live › vulnerability › CVE-2022-22706

Go to dashboard

high7.8Exploited in the wildInfrastructure

Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages

Arm Mali GPU kernel driver has an unspecified flaw that lets a non-privileged local user write to read-only memory pages. This is a kernel-level memory write, so an attacker who already runs code on the device can escalate privileges.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Mar 3, 2022 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 30, 2023.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Local user gains write access to read-only memory, enabling privilege escalation.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2022-22706

Go to dashboard

high7.8Exploited in the wildInfrastructure

Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Mar 3, 2022 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 30, 2023.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Local user gains write access to read-only memory, enabling privilege escalation.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Arm Mali Graphics Processing Unit (GPU)	vendor	–	–
arm bifrost gpu kernel driver	vendor	>= r0p0, < r36p0	r36p0
arm midgard gpu kernel driver	vendor	>= r26p0, < r32p0	r32p0
arm valhall gpu kernel driver	vendor	>= r19p0, < r36p0	r36p0

Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What people are saying

What the sources say, verbatim

Sources