Android Kernel CVE-2026-0125

Requires an attacker to already be running local, low-privileged code (e.g., an installed app) on an affected Android device; no user interaction is required (UI:N). The specific prerequisite is reaching the vulnerable ioctl entry points in vpu_ioctl.c and winning a race condition between multiple functions to trigger the use-after-free (CWE-416). Limiting factors: exploitation is purely local (AV:L - no remote vector), needs existing low-privilege execution on the device (PR:L), the VPU kernel driver must be present (a device/SoC-specific component tied to the Pixel/Android bulletin, so not every Android device is affected), and the timing race makes exploitation probabilistic and typically multi-attempt (AC:H). The exact trigger beyond 'a race condition in multiple functions of vpu_ioctl.c' is not detailed in the available sources.

Signals are consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local, authenticated (PR:L) use-after-free that requires winning a race (AC:H) and yields total compromise (C:H/I:H/A:H), matching the 7.0 HIGH rating and the SSVC 'Technical Impact: total' finding. Against that, every exploitation-likelihood signal is low: EPSS is 0.07% (0th percentile), SSVC 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no public exploit reference in the input - 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' indicating routine-but-prompt patching rather than emergency action, which is coherent with a high-impact local flaw that is hard to automate and not yet exploited. Net: this is a real local privilege-escalation issue worth patching on the monthly Android cadence, not a widespread-exploitation emergency. Note one point to verify: the CPE is the broad 'cpe:2.3:a:google:android:*' while the sole primary reference is a Pixel security bulletin and the affected component (vpu_ioctl.c) is a device/SoC-specific kernel driver - confirm with the Android/Pixel bulletin exactly which devices and kernel branches ship this driver.

A malicious or compromised low-privileged app already installed on an affected Android device repeatedly invokes the vulnerable vpu_ioctl.c ioctl paths to trigger a use-after-free via a race condition, then manipulates the freed kernel object to gain code execution at a higher privilege level - all with no user interaction. Because AC:H reflects the need to win a timing race, exploitation is not guaranteed on each attempt and typically requires many tries. No public exploit code was identified in the provided data.