What is the CVSS score of CVE-2025-36920?

CVE-2025-36920 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2025-36920?

CVE-2025-36920 is a critical ARM64 KVM kernel vulnerability enabling local privilege escalation on affected Linux systems.

How to fix or mitigate CVE-2025-36920?

Within 24 hours: Inventory all systems running ARM64 Linux with KVM virtualization enabled and assess exposure in production environments. Within 7 days: Implement network segmentation to restrict local access and disable KVM on non-essential systems; establish monitoring for suspicious privilege escalation attempts. Within 30 days: Apply vendor kernel patches immediately upon availability; prioritize systems supporting multi-tenant workloads or untrusted users.

Android CVE-2025-36920

HIGH

Improper Input Validation (CWE-20)

2026-03-10 dsap-vuln-management@google.com

Privilege Escalation Google Android

8.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 21:16 nvd

HIGH 8.4

DescriptionNVD

In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Android. In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.