How do you patch or mitigate CVE-2021-28664 (Arm Mali Graphics Processing Unit (GPU) Unspecified)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2021-28664 is to apply updates per vendor instructions. In practice, find every instance of Arm Mali Graphics Processing Unit (GPU) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What CVE-2021-28664 means for patching priorities

The practical response is to treat every Arm Mali Graphics Processing Unit deployment as a patch-and-verify item, not a tuning issue. Confirm where the GPU is present, apply the vendor security update or documented mitigation, and if you cannot remediate quickly, remove internet exposure or take the product out of service until it is fixed.

Because the issue is in a widely embedded graphics component, the main failure mode is incomplete inventory. A patch plan only works if you can find devices, boards, images, and vendor builds that actually include the vulnerable GPU stack.

Vulnerability Management Guide is useful here because this is a classic prioritisation problem: identify exposed assets, confirm the remediation path, and track completion with evidence rather than assumption.

How to reduce exposure if patching has to wait

If you cannot patch immediately, the safest short-term move is to narrow exposure. That usually means taking the affected system off the public internet, segmenting it from untrusted networks, and limiting any remote access paths that could let an attacker reach the vulnerable GPU software.

Temporary mitigation should be treated as a time-bounded exception, not a substitute for repair. If the affected system supports a business function that cannot pause, isolate it as tightly as possible and document who accepted the residual risk, for how long, and under what rollback condition.

Mobile Device Security Guide is a relevant internal reference when the vulnerable GPU sits in phones, tablets, embedded mobile platforms, or managed endpoints that depend on network exposure control and device policy.

What to check after remediation

After patching or mitigation, review logs and telemetry for signs of earlier exploitation, because CISA flagged this flaw as actively exploited. Look for unusual process launches, suspicious crashes, unexplained privilege changes, odd network connections, and any device behaviour that began before the fix.

If you find indicators of compromise, treat the patch as only one step in the response. You may need to rebuild the system, validate firmware and OS integrity, and rotate any credentials or sessions that were reachable from the compromised device.

Vulnerability Management Guide also matters after remediation because verification is part of closing the event, not a postscript. A vulnerability is not truly resolved until you can show the asset is fixed, exposure has been reduced, and any prior abuse has been checked.

Risk and Threat Considerations

This CVE matters because active exploitation changes the urgency from ordinary maintenance to exposure management. If the vulnerable GPU is reachable from the internet or sits on a broadly exposed endpoint, an attacker may be able to use the flaw before your normal patch cycle reaches it.

Failure mechanism: The weakness becomes dangerous when vulnerable systems remain discoverable, reachable, and unverified. In that state, delayed patching, weak segmentation, or missing asset inventory gives an attacker a practical window to exploit the issue and establish a foothold.

Impact: The likely result is unauthorized access, system compromise, or follow-on abuse of the affected device or service. Even where the initial flaw is narrow, the downstream consequence can include broader compromise if the system holds sensitive workloads, credentials, or trusted network placement.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This CVE requires finding affected assets, patching them, and verifying closure.
Recommendation — Prioritise the vulnerable GPU assets in your continuous vulnerability process and verify remediation completion.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The answer centers on patching, mitigation, and post-fix verification for a known exploited flaw.
Recommendation — Track the vulnerable GPU issue through remediation, exception handling, and closure evidence.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Patch or mitigate is the core control response to this actively exploited software flaw.
	RA-5 — Vulnerability Monitoring and Scanning	You first need reliable asset discovery and exposure confirmation before remediation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-remediation log review is needed to detect earlier exploitation of the flaw.
Recommendation — Apply approved updates or mitigations promptly and verify the flaw is removed from service. Scan and inventory affected systems so every vulnerable GPU instance is identified and tracked. Review logs and alerts for indicators that the vulnerability was abused before patching.

Practitioner Guidance

What to prioritise: Start with exposure first, then patching. Systems that are internet-facing, production-critical, or difficult to rebuild deserve immediate attention because they combine higher exploitability with higher business impact.

What to verify: Confirm the exact vendor build, not just the device model, because GPU components can ship through firmware, OS images, or vendor-specific packages. Keep evidence that each affected asset was identified, remediated, and checked for prior compromise.

Decision rule: If you cannot apply the update promptly, reduce reachability immediately and set a short remediation deadline. If the asset cannot be safely isolated, removal from service is the safer option than leaving a known exploited flaw exposed.

Practitioner takeaway: For an actively exploited vulnerability, the right sequence is inventory, exposure reduction, patching, then compromise review. Skipping any one of those steps leaves a workable attack path in place.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org