Executive brief
Android's KVM hypervisor contains a use-after-free vulnerability in the IOMMU (Input/Output Memory Management Unit) mapping function. This kernel-level flaw allows a local attacker to escalate privileges and execute code with higher system permissions, potentially compromising device security and enabling unauthorized access to sensitive data.
Technical details
The vulnerability is a use-after-free condition in the kvm_iommu_map_sg function within arch/arm64/kvm/hyp/nvhe/iommu/iommu.c, caused by a missing permission check. The root cause is the lack of validation when mapping into the identity mapping (idmap) domain, a special kernel domain that should not be a target for map_sg operations. An attacker with local access can trigger this flaw to access freed memory, leading to local privilege escalation. The vulnerability affects Android kernels and was fixed by rejecting any attempt to map into the idmap domain. No user interaction is required for exploitation.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-05-26: patched: Fix committed to Android kernel common repository