{"id":"CVE-2022-22706","kind":"vulnerability","aliases":["CVE-2022-22706"],"related":[],"title":"Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages","description":"Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Arm Mali GPU kernel driver has an unspecified flaw that lets a non-privileged local user write to read-only memory pages. This is a kernel-level memory write, so an attacker who already runs code on the device can escalate privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-03-30T00:00:00+00:00","products":[{"name":"Arm Mali Graphics Processing Unit (GPU)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"arm bifrost gpu kernel driver","fixed":["r36p0"],"affected":">= r0p0, < r36p0","ecosystem":"vendor"},{"name":"arm midgard gpu kernel driver","fixed":["r32p0"],"affected":">= r26p0, < r32p0","ecosystem":"vendor"},{"name":"arm valhall gpu kernel driver","fixed":["r36p0"],"affected":">= r19p0, < r36p0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","arm-mali","embedded-linux","exploited","gpu-drivers","infrastructure"],"not_affected_if":["no-mali-gpu-driver"],"how_to_check":null,"fix":"Apply the vendor updates per Arm's advisory for the Mali GPU kernel driver; the affected and fixed driver versions are unknown from the sources.\nCISA's KEV entry requires applying updates per vendor instructions.","status":"open","published_at":"2022-03-03T15:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:26+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:08:26Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per Arm's advisory for the Mali GPU kernel driver; the affected and fixed driver versions are unknown from the sources.\nCISA's KEV entry requires applying updates per vendor instructions.","reach":"local","impact":"high","summary":"Arm Mali GPU kernel driver has an unspecified flaw that lets a non-privileged local user write to read-only memory pages. This is a kernel-level memory write, so an attacker who already runs code on the device can escalate privileges.","category":"infrastructure","who_cares":["android","arm-mali","embedded-linux","gpu-drivers"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains write access to read-only memory, enabling privilege escalation","analyst_note":"Find Arm's security bulletin for CVE-2022-22706 to get affected driver versions and fixed releases, and how to check the installed Mali driver version on devices.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-mali-gpu-driver"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":2821,"output_tokens":404,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':23A,26A '-22706':24A,27A 'access':15A,125C 'achiev':13A,123C 'action':134C 'allow':6A,116C 'alreadi':97B 'android':49B 'appli':135C 'arm':1A,28A,34A,39A,44A,51B,61B,106C 'arm-mali':50B 'attack':95B 'bifrost':35A 'cisa':132C 'code':99B 'contain':111C 'cve':22A,25A 'devic':102B 'driver':5A,38A,43A,48A,59B,65B,110C 'embed':54B 'embedded-linux':53B 'escal':104B 'exploit':56B 'flaw':69B 'gpu':3A,33A,36A,41A,46A,58B,63B,108C 'gpu-driv':57B 'graphics':30A 'infrastructur':60B 'instruct':139C 'kernel':4A,37A,42A,47A,64B,89B,109C 'kernel-level':88B 'let':71B 'level':90B 'linux':55B 'local':76B 'mali':2A,29A,52B,62B,107C 'memori':20A,83B,91B,130C 'midgard':40A 'non':9A,74B,119C 'non-privileg':8A,73B,118C 'page':21A,84B,131C 'per':137C 'privileg':10A,75B,105B,120C 'processing':31A 'read':18A,81B,128C 'read-on':17A,80B,127C 'requir':133C 'run':98B 'unit':32A 'unspecifi':68B,113C 'updat':136C 'user':11A,77B,121C 'valhall':45A 'vendor':138C 'vulner':114C 'write':14A,78B,92B,124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-03T15:15:08+00:00","kev":{"dateAdded":"2023-03-30","dueDate":"2023-04-20","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22706","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22706","severity":null,"published_at":"2023-03-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22706","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22706","severity":null,"published_at":"2022-03-03T15:15:08+00:00","modified_at":"2026-06-17T04:28:50+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":2734,"url":"https://news.ycombinator.com/item?id=50220042","title":"Show HN: Autonomous root for Tcl Android TV via CVE-2022-22706","kind":"post","source":"hackernews","text":"Show HN: Autonomous root for Tcl Android TV via CVE-2022-22706\nhttps://gitlab.com/c4psu13/mali-pagecache-root\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-24T10:51:35+00:00","relation":"discussion","confidence":null,"note":"1 points, 0 comments"},{"id":2739,"url":"https://x.com/_r_netsec/status/2113949460992868737","title":"@_r_netsec: Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-202","kind":"post","source":"x","text":"Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-2022-22706 (Mali GPU page-cache write) https://t.co/X8loFTWsGN\n\nlikes 0 reposts 1","published_at":"2026-10-24T11:03:21+00:00","relation":"discussion","confidence":null,"note":"@_r_netsec"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}