CVE-2026-0152: In OSMMapPMRGeneric of pmr_os

Synopsis

This is a local privilege escalation vulnerability in the Android kernel, specifically in the OSMMapPMRGeneric function of pmr_os.c. A logic error allows an attacker with a low-privilege shell on the device to issue a crafted system call that expands a Virtual Memory Area (VMA) out of its intended bounds, violating kernel memory isolation. Successful exploitation gives the attacker full read, write, and execution control at the kernel level, effectively rooting the device. No fix version has been published yet; HarborGuard is tracking the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed before exploitation.

• Victim interactionNot required

  No user interaction is required; the attacker can execute the exploit entirely on their own without social engineering or user assistance.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions or special memory layout requirements.

Blast Radius

• Reads arbitrary kernel memory, including credentials, cryptographic keys, and session tokens stored by other processes.
• Writes to kernel data structures, allowing modification of security policies, file system permissions, or process privilege levels.
• Achieves full kernel-level code execution, effectively rooting the device and bypassing all OS-enforced access controls.
• Crashes or destabilizes the kernel at will, causing device outages or denial of service for all co-resident processes.