Executive brief
A vulnerability in the Android operating system's graphics driver controller could allow a local attacker to cause a persistent denial of service. This means an affected device could become unresponsive or experience repeated system failures, potentially requiring a factory reset or technical intervention to restore service. The issue occurs automatically without requiring any specific action from the user.
Technical details
A denial of service (DoS) vulnerability exists in the 'updateState' method of GraphicsDriverEnableAngleAsSystemDriverController.java within the Android System component. The flaw is triggered by an 'unusual root cause' that leads to a persistent DoS state. Exploitation can be achieved by a local attacker without any additional execution privileges or user interaction. The vulnerability affects Android versions 14, 15, 16, and 16-qpr2. A fix is available as part of the June 2026 Android Security Bulletin (patch level 2026-06-05).
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: disclosed: Vulnerability published in Android Security Bulletin and NVD.
- 2026-06-05: patched: Security patch level 2026-06-05 or later addresses this issue.