CVE-2026-0137: In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf

Synopsis

CVE-2026-0137 is a use-after-free vulnerability in the Android kernel's Edge TPU DMA buffer management, specifically in the edgetpu_sync_fence_group_shutdown() function of edgetpu-dmabuf.c. The flaw is exploitable locally by an attacker who already holds a low-privilege account on the device, requiring no network access or victim interaction. Successful exploitation gives the attacker full read, write, and execution control at the system level, enabling privilege escalation to root or equivalent. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; the attacker does not need administrative or root credentials to trigger the vulnerability.

• Victim interactionNot required

  No user action is required; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layouts, or other environmental factors to succeed.

Blast Radius

• Attacker escalates from a low-privilege process to System-level execution, gaining full control over the Android kernel context.
• Reads arbitrary kernel memory, exposing credentials, session tokens, encryption keys, and other sensitive data held in kernel space.
• Writes to arbitrary kernel memory, allowing persistent modification of kernel data structures, security policies, or stored application data.
• Crashes or destabilizes the kernel, causing device reboot or sustained denial of service for all processes on the host.