Android Kernel CVE-2026-0133

Exploitation requires local access with an existing low-privilege foothold on the affected Android/Pixel device (CVSS PR:L), achievable for example by a malicious installed app or compromised local process; no user interaction is required (UI:N) and the attack is not remote (AV:L). The specific prerequisite stated by the source is a missing permission check in the affected kernel driver path, which allows an otherwise unauthorized privileged operation. Limiting factors: the attacker must first run code locally at some privilege level, exploitation is not automatable per SSVC, and it is confined to affected Android kernel builds/patch levels; the precise code path that must be reached is not described in the available sources.

This is a credible but not emergency-grade Android kernel privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms local-only exploitation requiring the attacker to already hold some privilege on the device (PR:L), with total impact (C:H/I:H/A:H) consistent with CWE-862 missing-authorization leading to escalation. The decision signals are mostly cooling: EPSS is 0.07% (0th percentile), SSVC reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public exploit reference - so this is no public exploit identified at time of analysis. The only elevating signals are SSVC Technical Impact: total and the vuln.today 'this_week' priority label, which track the high local impact rather than any evidence of active use. Net: a real, patch-this-cycle local EoP, not a widely-exploited remote threat. Note a description/mechanism tension: the title cites smmu_attach_dev in arm-smmu-v3.c (an ARM SMMU driver path) while the impact text describes signing malicious Android Runtime bootclass artifacts via a missing permission check - these do not obviously connect, and the description reads like a templated Android-bulletin summary; verify the actual trigger with the Android/Pixel bulletin.

A malicious or compromised low-privileged app or local process on an affected Android/Pixel device invokes the vulnerable code path, and because a permission check is missing it gains the ability to perform a privileged operation it should not be authorized for, escalating to higher privilege without user interaction. No public exploit code is referenced, so this scenario is inferred from the CVSS local vector and the missing-authorization weakness rather than from a demonstrated PoC.