Executive brief
A kernel vulnerability in Google Pixel devices allows unauthorized access to sensitive system memory without requiring special privileges or user interaction. An attacker with local access could read confidential information stored in kernel memory, potentially including cryptographic keys, authentication tokens, or other sensitive data that could be used for further attacks.
Technical details
The vulnerability is an out-of-bounds read in the gf_algo_get_cached_dump_data function in gf_algo.c, caused by a missing bounds check on memory access. The flaw is triggered locally and requires no additional execution privileges. An attacker with local code execution can read arbitrary kernel memory beyond intended buffer boundaries, leading to information disclosure. The vulnerability is addressed in Android Pixel devices receiving the 2026-09-05 security patch level or later.
Affected products
- Google Pixel firmware prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched