Summary
Google heeft kwetsbaarheden verholpen in Android. In deze update zijn ook updates meegenomen voor closed-source componenten van Qualcomm, Imagination Technologies, Unisoc en MediaTek.
Samsung heeft kwetsbaarheden in Samsung Mobile verholpen die relevant zijn voor Samsung mobile devices.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden om een malafide app te installeren en uit te voeren, of een malafide link te volgen.
Google heeft verder, zoals gebruikelijk, weinig inhoudelijke informatie beschikbaar gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 14, 15 en 16.
Samsung heeft updates uitgebracht om kwetsbaarheden die relevant zijn voor Samsung Mobile devices te verhelpen.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 115
-
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
High 7.8
Integer Overflow or Wraparound in Graphics
Memory corruption while using alignments for memory allocation.
KEV Mar 3, 2026 -
Critical 9.8
GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this cou…
-
Critical 9.8
tls: make sure to abort the stream if headers are bogus
In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read o…
-
Critical 9.8
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Th…
-
Critical 9.8CVE-2026-0006 Public exploit
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead …
-
Critical 9.1
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, …
-
High 8.8
GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario. Improper resource management and reference counting on an internal r…
-
High 8.4
In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This coul…
-
High 8.4
In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events d…
-
High 8.4
In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a conf…
-
High 8.4
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an…
-
High 8.4
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypas…
-
High 8.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the c…
-
High 8.4
In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate fil…
-
High 8.4
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. T…
-
High 8.4
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escala…
-
High 8.4
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in …
-
High 8.4
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could l…
-
High 8.4CVE-2026-0010 Public exploit
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This co…
-
High 8.4
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a lo…
-
High 8.4CVE-2026-0013 Public exploit
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…
-
High 8.4
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain per…
-
High 8.4
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a …
-
High 8.4
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypas…
-
High 8.4
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This c…
-
High 8.4
In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to…
-
High 8.4
In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds c…
-
High 8.4
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could …
-
High 8.4
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper…
-
High 8.4
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing fi…
-
High 8.4
In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead…
-
High 8.4
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the c…
-
High 8.4CVE-2026-0047 Public exploit
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information du…
-
High 8.4
Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attacke…
-
High 8.2
KVM: arm64: Check the untrusted offset in FF-A memory share
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(str…
-
High 7.8
GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for…
-
High 7.8
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
High 7.8
tls: handle data disappearing from under the TLS ULP
In the Linux kernel, the following vulnerability has been resolved: tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered befor…
-
High 7.8
vsock: Do not allow binding to VMADDR_PORT_ANY
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…
-
High 7.8
Use After Free in HLOS
Memory corruption while deinitializing a HDCP session.
-
High 7.8
Out-of-bounds Write in HLOS
Memory corruption while processing a secure logging command in the trusted application.
-
High 7.8
Use of Uninitialized Variable in HLOS
Memory corruption while processing identity credential operations in the trusted application.
-
High 7.8
Improper Access Control for Register Interface in SCE-Mink
Memory Corruption when accessing trusted execution environment without proper privilege check.
-
High 7.8
Buffer Copy without Checking Size of Input in DSP Service
Memory corruption while passing pages to DSP with an unaligned starting address.
-
High 7.8
Buffer Copy Without Checking Size of Input in DSP Service
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
-
High 7.8
Double Free in Graphics
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
-
High 7.8
Improper Release of Memory Before Removing Last Reference in Graphics
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
-
High 7.8
Use After Free in Graphics
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
-
High 7.8
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could l…
-
High 7.8
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directo…
-
High 7.8
In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission du…
-
High 7.8
In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previo…
-
High 7.8
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lea…
-
High 7.8
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.…
-
High 7.8
Buffer Over-read in Graphics
Memory Corruption when adding user-supplied data without checking available buffer space.
-
High 7.8
DNG SDK | Integer Overflow or Wraparound (CWE-190)
DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope…
-
High 7.8
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjac…
-
High 7.8CVE-2026-0023 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…
-
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due…
-
High 7.8
In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This …
-
High 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic e…
-
High 7.7
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the …
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.4
In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalati…
-
High 7.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This…
-
High 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel info…
-
High 7.4
GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet
Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine.
-
High 7.1
Exposed Dangerous Method or Function in HLOS
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
-
High 7.1
Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.
-
High 7.1
DNG SDK | Heap-based Buffer Overflow (CWE-122)
DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploita…
-
High 7.1
DNG SDK | Out-of-bounds Read (CWE-125)
DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Explo…
-
High 7.0
In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local es…
-
Medium 6.8
Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker…
-
Medium 6.7
In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead t…
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In display, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalat…
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reus…
-
Medium 6.5
In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. T…
-
Medium 6.5
In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote d…
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing a received frame with an excessively large authentication information element.
-
Medium 6.5
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaust…
-
Medium 6.5
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5CVE-2026-20404 Public exploit
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input …
-
Medium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input …
-
Medium 6.2
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing li…
-
Medium 6.2
In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error i…
-
Medium 6.2CVE-2026-0014 Public exploit
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input …
-
Medium 6.2
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input val…
-
Medium 5.9
GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data c…
-
Medium 5.5
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This cou…
-
Medium 5.5
In multiple locations, there is a possible persistent denial of service due to improper input validation. This could le…
-
Medium 5.1
Mali GPU Kernel Driver allows improper GPU processing operations
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to expos…
-
Medium 5.1
Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attac…
-
Medium 4.8
Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the bac…
-
Medium 4.0
In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of …
-
Low 3.5
GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driv…
-
Unscored —
f2fs: fix to truncate preallocated blocks in f2fs_file_open()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate preallocated blocks in f2fs_file_open() chenyuwen reports a f2fs bug as below: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011 fscry…
Revision history
-
#1.0.0
Initiele versie