CVE-2026-0138: In lwis_io_buffer_write of lwis_io_buffer

Synopsis

An out-of-bounds write vulnerability exists in the Android kernel's lwis_io_buffer_write function (lwis_io_buffer.c), reachable by a local attacker who already holds system-level execution privileges. Because the bug involves memory corruption, a successful exploit gives the attacker full control over kernel memory. This can lead to local privilege escalation, arbitrary code execution in the kernel, and complete compromise of the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Google publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access path is required to reach the vulnerable code.

• AuthenticationRequired

  A low-privilege local account is sufficient; however, the CVE description specifies that System execution privileges are needed, meaning the attacker must already hold elevated system-level access on the device.

• Victim interactionNot required

  No user interaction of any kind is required; the attacker can trigger the vulnerable code path entirely on their own.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or memory-layout prerequisites beyond the privilege requirement.

Blast Radius

• Reads any memory region accessible to the kernel, including stored credentials, session tokens, and encryption keys held in kernel space.
• Modifies kernel memory structures, allowing the attacker to alter security policies, bypass access controls, or overwrite arbitrary process memory.
• Executes attacker-supplied code at kernel privilege level, giving full control over the operating system and all processes running on the device.
• Crashes or destabilizes the kernel, causing the affected device to reboot or become unresponsive.