Executive brief
A vulnerability in Google Pixel device kernel firmware allows a local attacker with system-level access to write data beyond allocated memory boundaries when loading GNSS (GPS) firmware images. This memory corruption could enable privilege escalation or system compromise without requiring user interaction, affecting the security of supported Pixel phones.
Technical details
The vulnerability is an out-of-bounds write in the link_load_gnss_image function of link_device.c, caused by missing bounds validation before writing to a memory buffer. The attack vector is local, requiring System execution privileges to trigger. An attacker can exploit this to corrupt kernel memory and achieve privilege escalation. The issue was addressed in Google Pixel firmware with the 2026-09-05 security patch level, published September 15, 2026.
Affected products
- Google Pixel Prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched