Is CVE-2021-28664 (Arm Mali Graphics Processing Unit (GPU) Unspecified) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-28664 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.

What “being exploited in the wild” means for this CVE

For a vulnerability like CVE-2021-28664, “exploited in the wild” means more than proof-of-concept code or theoretical risk. It means there is reliable evidence that attackers were using the flaw against real systems, which is why CISA placed it in the CISA Known Exploited Vulnerabilities Catalog. That makes the issue operational, not hypothetical.

The practical question is whether the vulnerable Arm Mali GPU kernel driver exists anywhere in your environment, including embedded devices, mobile platforms, or systems that inherit the driver through the OS image. If it does, exposure is not just about crash risk, but about the possibility of privilege gain, memory corruption, and unauthorized modification of other processes.

Why a GPU kernel driver flaw becomes a real security problem

This CVE matters because the vulnerable component sits in a privileged part of the operating system stack. A flaw that lets a non-privileged user gain write access to read-only memory or reach root-level privileges can turn a local foothold into full device compromise. That is a much higher-value outcome than a user-space application bug because the attacker is targeting the trust boundary between ordinary code and the kernel.

When kernel memory can be corrupted, secondary effects follow quickly: security controls may be bypassed, process isolation can fail, and other applications can be altered or monitored from a privileged context. For defenders, the key point is that exploitation may look like a normal local process until the point where privilege boundaries are already lost.

How to confirm exposure and reduce the blast radius

Start by identifying which endpoints, devices, or firmware builds actually use the affected Arm Mali GPU driver, then determine whether the vulnerable driver is loaded and reachable in the current operating state. CISA’s KEV listing confirms active exploitation, so exposure should be treated as urgent rather than deferred to the next routine maintenance window.

If patching or vendor remediation must wait, reduce the blast radius as much as possible. That usually means limiting who can execute untrusted code locally, tightening application allowlisting where practical, and increasing monitoring for privilege escalation, unusual kernel activity, and unexplained process tampering. The goal is to make exploitation harder and easier to detect, not to assume the lack of a current alert means the system is safe.

Risk and Threat Considerations

Active exploitation of a kernel-driver flaw raises the stakes because attackers only need a local execution path before they can attempt privilege escalation or memory tampering. On shared or high-value endpoints, a successful exploit can undermine process integrity, access controls, and any security tooling that depends on the kernel remaining trustworthy.

Failure mechanism: The attacker abuses the GPU driver’s memory-handling weakness to write where they should not, corrupt kernel state, or elevate privileges from an unprivileged context.

Impact: A compromised system may lose isolation between processes, permit root-level control, and expose data or credentials held in memory, which can broaden the incident from a single host to a larger environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Exploit-active flaws require prompt remediation planning.
	SI-4 — System Monitoring	Active exploitation calls for monitoring privilege escalation and tampering signals.
Recommendation — Prioritise remediation for exposed systems and track exception handling until fixed. Monitor for abnormal kernel activity and indicators of exploitation on exposed hosts.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed CVEs require fast identification and prioritisation of affected assets.
Recommendation — Identify exposed assets quickly and accelerate remediation for KEV-listed vulnerabilities.
OWASP ASVS	V15 — Secure Coding and Architecture	Kernel-driver weakness highlights architecture-level trust boundary failure.
Recommendation — Validate that privileged components enforce memory and privilege boundaries correctly.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Managed	The question is about an exploited vulnerability and how exposure should be managed.
Recommendation — Identify affected assets and manage the vulnerability as an active risk condition.

Practitioner Guidance

What to verify: Confirm whether any in-scope asset uses an Arm Mali GPU kernel driver version that the vendor has addressed for this issue, and verify whether that driver is present on devices outside your standard server inventory, including laptops, tablets, and managed mobile fleets.

Decision rule: If the device is exposed and you cannot immediately remediate, treat it as an exploitable vulnerability with possible privilege-escalation impact, then prioritize containment and hunting for prior compromise before relying on normal patch queues.

Practitioner takeaway: Because CISA listed this CVE in KEV, the right response is to assume real attacker interest and focus first on exposure, containment, and compromise assessment, not on waiting for proof that your own environment has already been hit.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org