Android Kernel CVE-2026-0186

Exploitation requires the attacker to already possess System execution privileges on the device (PR:H) and local access (AV:L) to reach the ac_init_one_sswrp initialization path in init.c; no user interaction is needed. This is a post-compromise privilege-escalation primitive, not a remote or unauthenticated vector - the pre-existing System-level foothold is the primary limiting factor, sharply narrowing realistic exploitation to attackers who have already breached a highly privileged process. Applies to affected Android/Pixel builds patched in the 2026-09-01 bulletin.

This is a genuine but low-priority vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, vendor base 6.7 Medium) is internally consistent with the description: a local (AV:L) logic error requiring the attacker to ALREADY hold System execution privileges (PR:H) with no user interaction. The high PR requirement is the decisive risk-limiter - an attacker who already runs as System has extensive control, so the marginal escalation this grants is narrow, which is why the score lands at Medium rather than the 8.4 seen on the PR:N unprivileged Android siblings this month. The C:H/I:H/A:H impact triad is generous boilerplate typical of Android bulletin entries. EPSS is very low at 0.12% (2nd percentile), consistent with no automation potential given the local + high-privilege prerequisites. Exploitation status: no public exploit identified at time of analysis (no KEV, no POC). No SSVC decision data was provided. Signals are consistent across the board (low EPSS, no KEV, high PR, local vector all point the same direction) - no conflicts to flag. Net: a real defense-in-depth fix worth patching in the normal Android update cycle, not an emergency.

An attacker who has already achieved code execution in a process running with Android System privileges invokes the flawed ac_init_one_sswrp logic path in init.c to escalate further within the platform. No user interaction is required, but the high pre-existing privilege prerequisite makes this a post-compromise escalation step rather than an initial-access vector. No public proof-of-concept is available.