CVE-2026-0143: In lwis_device_external_event_emit of lwis_event

Synopsis

A use-after-free vulnerability exists in the lwis_device_external_event_emit function of the Android kernel's lwis_event.c. The flaw is reachable locally by an attacker who already holds a low-privilege account on the device, without requiring any user interaction. Successful exploitation causes memory corruption that grants the attacker elevated system execution privileges. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient to trigger the vulnerable code path.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker operates entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors must be arranged.

Blast Radius

• A successful attacker gains system-level execution privileges, escaping the restrictions of their original low-privilege account.
• Memory corruption from the use-after-free allows the attacker to read arbitrary kernel memory, exposing credentials, keys, and sensitive runtime data.
• The attacker can write to kernel memory, modifying security controls, process credentials, or persisted state on the device.
• Kernel memory corruption can crash the affected device or render it unbootable, causing a full service disruption.