Executive brief
Google's Trusty operating system, which runs in a secure processor on Android and Pixel devices, contains a race condition in memory management that allows local attackers to corrupt kernel memory and escalate their privileges. An attacker with code execution on the device's secure processor could exploit this flaw to gain complete control of the Trusty kernel without requiring additional permissions or user interaction.
Technical details
A race condition in the ARM64_TLBI function (part of the memory management unit handling in mmu.h) within Trusty can lead to memory corruption. The vulnerability stems from improper synchronization during TLB (Translation Lookaside Buffer) invalidation operations, allowing concurrent access to kernel memory structures. This race condition is exploitable from a local context without additional execution privileges, enabling privilege escalation within the Trusty secure environment. The vulnerability is addressed through patching the synchronization logic in ARM64_TLBI operations.
Affected products
- Google Trusty
Timeline
- 2026-09-15: disclosed: Published in Pixel Update Bulletin and NVD