Executive brief
The Android kernel's memory allocator for virtualization (KVM) contained a race condition that could allow a local attacker to read or write memory without authorization. This vulnerability enables privilege escalation from unprivileged user processes to gain elevated system access, potentially allowing unauthorized modification of system data or execution of arbitrary code.
Technical details
A race condition exists in alloc.c within the ARM64 KVM hypervisor's heap allocation logic. The vulnerability stems from improper synchronization between per-CPU memory caches during allocation refill and concurrent reclaim operations across CPUs. An attacker with local access can exploit this race condition to achieve unauthorized read/write access to kernel memory. The attack vector is local, requires no special privileges or user interaction, and results in privilege escalation. The issue has been patched by consolidating per-CPU memcaches into a single synchronized common memcache structure.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-06-12: patched: Patch merged in kernel/common repository