Skip to content
OpenAdvisories
High · 8.4 CVE-2026-56966 EUVD-2026-122738GHSA-hj42-p2xw-r9mc

In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory…

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by Google_Devices

Description

In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Google Android Android kernel —

Advisories 1

References