by Kastro
Paper/Archive/CVE-2026-0106

CVE-2026-0106

Google Android — In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check.

EPSS 0.1%CVSS 9.3
critical.is priorityof 100
28
CVSS 9.3 (ADP)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 1.8.018 × 200.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
AndroidAndroid kernel–CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysource.android.com/docs/security/bulletin/pixel/2026/2026-02-01