> as far as I can tell GrapheneOS doesn't have the patch, yet.
That's not correct. Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver.
> the most recent mention on their releases page is for the 2022120300 release:
That's not the most recent mention on our releases page. This is the most recent relevant change:
> full 2023-01-05 security patch level
Here is a previous Mali GPU driver update:
> kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to QPR2 Beta 2 release
Here is another previous Mali GPU driver update:
> kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to r38p1 along with other changes included in the QPR2 Beta 1 including a bunch of security fixes previously neglected upstream (GrapheneOS will continue applying further updates downstream)
Looking at the version number is not enough. ARM makes separate security patches available to their partners. Google is primarily shipping the backported security patches and gradually upgrades the driver version. The reason for this is that there are massive changes to the Mali GPU kernel driver for the Tensor SoC GPU. This is why GrapheneOS can't simply update it to r41p0 immediately because there are a massive number of complex synchronization, GPU command quality of service and other changes conflicting with newer releases. It makes the most sense to apply the standalone security patches. Unfortunately, ARM doesn't publish the standalone security patches for the public and we need to obtain them from a vendor choosing to include and ship them since they have to publish the code.