CVE-2026-0125: Android VPU Race Condition Local Privilege Escalation

Technical summary

The vulnerability exists in multiple functions within vpu_ioctl.c where insufficient synchronization between concurrent operations creates a window for a use-after-free (CWE-416) condition. An unprivileged local process can craft a race to cause the driver to reference memory that has already been freed, potentially corrupting kernel state or executing arbitrary code with elevated privileges. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates this requires local access and low privileges, but the attack complexity is high—suggesting the race window is narrow, though not mitigated by default protections.

Business impact

Devices running vulnerable Android versions face a direct path to privilege escalation. A malicious or compromised low-privilege app could gain kernel-level access, leading to complete device compromise including data exfiltration, persistent malware installation, or lateral movement within a corporate environment. For organizations deploying Android devices in sensitive workflows (finance, healthcare, government), this represents a pathway to insider-level compromise without requiring a user's awareness or consent.

Affected systems

Google Android is the affected platform. The specific Android versions vulnerable to this flaw have not been enumerated here; confirm the precise version ranges from Google's official security bulletin. The VPU driver is typically present on Android devices with dedicated video hardware acceleration, though the exact device list depends on manufacturer implementations and chipset design.

Exploitability

Exploitability is moderate. The vulnerability requires local access and a valid low-privilege user account on the target device—not a zero-click remote attack. However, it is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not been publicly documented. The high attack complexity (AC:H) reflects the timing-sensitive nature of triggering the race condition reliably. An attacker would need to understand the driver's state machine and potentially make multiple attempts or use side-channel techniques to increase success probability.

Remediation

Apply the security patch from Google for your Android version as soon as it becomes available via official security updates. The patch will address the synchronization issue in vpu_ioctl.c and eliminate the race window. Until patches are available, restrict device access to trusted users and monitor for suspicious driver-level activity. For organizations with lengthy update cycles, consider quarantining vulnerable devices from sensitive network segments.

Patch guidance

Check Google's official Android security advisory for CVE-2026-0125 to identify affected versions and corresponding patch levels. Patches are typically rolled out through monthly security updates or critical out-of-band releases. Device manufacturers may introduce delays, so verify patch availability for your specific device model and Android version. Deploy patches across all affected devices and verify installation through device settings (Settings > About Phone > Security Patch Level or equivalent).

Detection guidance

Look for patterns of repeated failed or hanging calls to VPU device driver interfaces (often accessed through /dev/vpu or similar device nodes). Monitor for user-space processes that crash immediately after interacting with video-related hardware APIs, which may indicate failed race exploitation. On rooted or forensically analyzed devices, examine kernel logs for use-after-free warnings (UAF/KASAN) correlating with vpu_ioctl operations. Runtime behavior detection is difficult without instrumented kernels; focus detection efforts on patch deployment verification and access controls.

Why prioritize this

This vulnerability merits rapid patching because it offers direct local privilege escalation with no user interaction required and only low-privilege prerequisites. Although attack complexity is high and active exploitation is not yet confirmed, the severity is amplified in scenarios where low-privilege app isolation is the primary security boundary—a common assumption on personal Android devices and some enterprise deployments. The high CVSS score (7.0) reflects the integrity and confidentiality impact of kernel compromise.

Risk score, explained

The CVSS v3.1 score of 7.0 (HIGH) reflects a local attack vector, high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), and only low-privilege requirements (PR:L). The high attack complexity (AC:H) prevents a critical rating but acknowledges that reliable exploitation demands careful timing. In isolation, the score is mid-to-high; contextualized within Android's threat model where apps are the primary untrusted boundary, this represents a significant privilege boundary violation.

Frequently asked questions