CVE-2023-5643 is a high severity (CVSS 7.8) out-of-bounds write in the Arm Bifrost, Valhall and 5th Gen GPU kernel drivers, releases r41p0 through r45p0. A local, non-privileged user can trigger it. The fixed release is not named in the record, so check the Arm advisory and your device vendor.
What's affected
- Products: Arm Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver.
- Affected: from r41p0 through r45p0 for all three drivers.
- Fixed version: not stated in the NVD record, and the Arm Security Center page denied access to automated requests during this review. Read the Arm Mali GPU Driver Vulnerabilities page for the fixed release.
- Severity: 7.8 High (local attack, low privileges needed).
- Condition: the record says exploitation depends on the Mali kernel driver configuration and on the attacker preparing the system memory carefully.
How to check if you're exposed
Most teams will not run Arm's driver directly. The driver ships inside a device vendor's kernel, so the first job is to find out which Mali driver release your devices use. On a Linux based device where you have a shell, the loaded module and its version are often visible:
uname -r
modinfo mali_kbase 2>/dev/null | head
The module name can differ by vendor. If you cannot read it, ask the device or SoC vendor which Mali driver release your firmware contains, and whether it falls in r41p0 through r45p0.
What to do now
- Open the Arm advisory and note the fixed driver release for each of the three driver families.
- Ask your device or SoC vendor whether your firmware contains an affected release, and when a patched build is due.
- Install vendor firmware or kernel updates as they appear, and prioritize devices where untrusted code can run locally.
- Where you cannot update, limit which apps or users can reach the GPU device node, if your platform supports that.
- Add the device models and their driver releases to your asset inventory.
Why it matters
The weakness is an out-of-bounds write, CWE-787. The driver handles GPU memory on behalf of user space programs, and a mistake in that handling lets a local user write outside the intended buffer. Kernel level memory writes are among the most serious memory safety bugs, because they happen in code that runs with full system privileges.
The score is high rather than critical because the attacker needs local access and the record says the memory must be carefully prepared. That still matters on devices that run third party apps or shared workloads. The record does not list the CVE as known exploited. The practical problem is supply chain depth: the fix starts at Arm and reaches users only when each device maker ships an update.
Quick check
Why is the fixed version missing here?
The NVD record gives only the affected range, and the Arm page could not be read during this review. Do not guess a version. Use the Arm advisory.
Sources
Last reviewed: 19 October 2026.
