CVE-2023-3889: Mali GPU Kernel Driver exposes sensitive data from freed memory

Description

A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.

Scores

CVSS scores of CVE-2023-3889, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.18% · top 92% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer (opens in a new tab)All about CWE-119 and its CVEs
CWE-667 Improper Locking (opens in a new tab)All about CWE-667 and its CVEs

Affected products

Arm Ltd · Valhall GPU Kernel Driver
- affected r38p0 – ≤ r44p0

References (1)

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-3889](https://trackcve.app/badge/CVE-2023-3889.svg)](https://trackcve.app/cve/CVE-2023-3889)

Record last updated 16 Dec 2025, 18:13 UTC.