Mind the Gap

Project Zero researchers discovered and reported five vulnerabilities in the ARM Mali GPU kernel driver that can disclose physical addresses, cause physical-page use-after-free, and corrupt kernel memory—issues that can be chained to escalate privileges and fully compromise Android devices using Mali GPUs. ARM published patches (CVE-2022-36449) in July–August 2022, but Project Zero found that downstream vendors had not rolled the fixes out to affected devices, creating a significant patch gap and continued exposure.