Finding a Generic Mali GPU Read/Write Primitive for Real-World Exploit Development

No ratings

Presented at DEF CON Singapore 2026 by

Jun Yao

Shuquan Zhou

Guang Gong

In Mali GPU exploit development, a reliable arbitrary read/write (R/W) primitive is a critical technique for various vulnerability classes, and for specific cases, it is the sole prerequisite for successful exploitation. In current Mali GPU exploit development, implementing R/W primitive primarily follows two paths: relying on the OpenCL library or utilizing a Job Manager-based write primitive. However, vendor-specific modifications often undermine the versatility and stability of the OpenCL-based primitive, requiring significant adaptation. Meanwhile, the transition to architecture version 10 and beyond has rendered Job Manager-based methods entirely obsolete. These factors leave a technical gap for a flexible, universal, and library-independent R/W primitive on modern Mali GPUs. By tracing OpenCL-to-kernel interactions, we successfully deciphered the CSF commands and its underlying synchronization. We present Mali-RWP, the first stable, generic and library-independent R/W primitive that operates without any vendor runtime. By leveraging low-level completion feedback, Mali-RWP provides a robust, generic solution that fills the technical vacuum in exploit development for the modern CSF-based Mali GPUs