CVE-2026-0137: Android Edge TPU Use-After-Free Privilege Escalation

Technical summary

The vulnerability exists in the edgetpu_sync_fence_group_shutdown() function within edgetpu-dmabuf.c, a kernel driver component responsible for managing DMA buffer operations on Edge TPU devices. A use-after-free condition allows an attacker to reference memory that has already been freed, potentially enabling arbitrary code execution at the kernel privilege level. The affected code path is reachable by any user with local system access (UID-based privilege requirement), making it a practical attack surface for privilege escalation.

Business impact

Successful exploitation enables attackers to break out of application sandboxes and gain kernel-level control on Android devices equipped with Edge TPU hardware (commonly found in Google Pixel phones and certain enterprise Android deployments). This elevates the impact of any prior vulnerability used to gain initial local access, potentially enabling persistent malware installation, data exfiltration, or complete device compromise. Organizations relying on Android devices for sensitive workloads face elevated risk until patches are applied.

Affected systems

The vulnerability affects Google Android on devices with Edge TPU hardware acceleration. This includes Google Pixel smartphones and tablets with integrated Edge TPU co-processors, as well as other Android devices featuring compatible Tensor or similar Google-designed processors. The scope is limited to devices with this specific hardware; standard Android installations without Edge TPU are not affected.

Exploitability

Exploitability is straightforward for a local attacker already running code on the device. The CVSS vector (AV:L/AC:L/PR:L/UI:N) reflects that local access and standard user privileges are required, but no complex attack complexity or user interaction is needed. The use-after-free condition is deterministic and reliably triggerable, making this a high-confidence exploit target for privilege escalation chains. Public exploit development is not yet evident, but the simplicity of the underlying flaw suggests rapid weaponization is possible once patch details emerge.

Remediation

Organizations must apply security patches from Google as soon as they are released. Monitor Google's official Android Security & Privacy Year in Review bulletins and device-specific update schedules. For enterprise deployments, coordinate patch testing and rollout through your device management platform (MDM) to ensure timely coverage. Interim mitigation options are limited; consider restricting local app installation on high-risk devices until patches are verified and deployed.

Patch guidance

Verify the target Android version and device model against Google's official security bulletin for CVE-2026-0137 to obtain the correct patch build or security update version. Patches are typically distributed through over-the-air (OTA) updates or monthly security patch releases. Test patches in a controlled staging environment before wide deployment to ensure compatibility with your critical applications. Prioritize devices that run sensitive workloads or are deployed in high-risk environments (e.g., financial, healthcare, government).

Detection guidance

Kernel-level use-after-free exploits are difficult to detect in real time without specialized dynamic analysis or kernel security monitoring tools. Monitor system logs and SELinux audit logs for unusual kernel driver activity or crashes in edgetpu-related kernel modules. On Android, enable enhanced security features such as Exploit Mitigations (where available) and keep security framework components updated. Behavioral detection of unexpected privilege escalation patterns may indicate exploitation attempts, but signature-based detection is limited for memory corruption vulnerabilities.

Why prioritize this

This vulnerability merits high-priority patching because it enables local privilege escalation on Android devices with Edge TPU hardware—a growing segment of Google's flagship products. The low attack complexity (no user interaction, simple triggering conditions) and high impact (kernel-level code execution) create immediate risk. While KEV listing is not yet confirmed, the technical characteristics and public disclosure make weaponization likely. Organizations with Pixel device deployments should treat this as critical-urgency.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the confluence of local attack vector, standard user-level privilege requirement, no user interaction needed, and complete confidentiality, integrity, and availability impact at the system level. The primary limiting factor is the requirement for local code execution—this is not a remote exploit. However, for devices where threat models include sophisticated local attackers or malware chains, the score accurately represents the severe privilege escalation risk.

Frequently asked questions