CVE-2026-0125: In multiple functions of vpu_ioctl

Synopsis

Use-after-free vulnerability in the Android kernel's VPU (video processing unit) driver, specifically in multiple functions of vpu_ioctl.c, is reachable by a local attacker with a low-privilege account. Exploitation requires winning a race condition between concurrent kernel operations. Successful exploitation gives the attacker full local privilege escalation, allowing them to read, modify, or destroy data and processes at the kernel level. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative privileges are needed before exploitation.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the race condition entirely from their own process.

• Attack complexityDetail

  Exploitation is timing-dependent and requires the attacker to win a race condition between concurrent kernel operations, making reliable reproduction harder without specific environmental conditions.

Blast Radius

• A successful attacker gains kernel-level code execution, breaking out of any user-space privilege boundary.
• Confidential data accessible to the kernel, including credentials, cryptographic keys, and memory belonging to other processes, becomes readable.
• The attacker can modify kernel data structures, persisted files, or other processes' memory.
• The attacker can crash the kernel or render the device unavailable.