Samsung Exynos DPU CVE-2026-23790

Exploitation requires local code execution on an Android device powered by one of the nine affected Exynos chip families (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, or 2600). The attacker must hold at least a low-privilege account (PR:L), meaning a standard Android user or an installed application with permissions sufficient to interact with the DPU driver's DMA buffer management path - no root or elevated privilege is required to trigger the bug. High complexity (AC:H) implies a race condition or specific timing sequence must be achieved during the DMA buffer reallocation event, which limits opportunistic and automated exploitation. Remote exploitation is not possible (AV:L); the attacker must have physical device access or an already-deployed application on the target device. No special non-default configuration is required - the DPU driver is active on all affected devices using their display subsystem.

The CVSS 3.1 score of 4.2 (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) appropriately reflects the local-only attack vector and high exploitation complexity, though A:L appears conservative for a kernel heap double-free that can reliably panic the system. The Scope Changed metric is the most operationally significant signal: user-space code reaching kernel memory corruption via a driver bug is a well-understood privilege escalation primitive on Android, even if the complexity is high. The absence of a KEV listing and the lack of any public exploit or EPSS score in the provided intelligence both suggest no active exploitation campaign has materialized. Even a mid-sized mobile device management operation in gdynia should treat this as a medium-priority patch item - important for any fleet of Samsung Exynos Android devices but not requiring emergency out-of-band response given the AC:H constraint. The CPE undercoverage (NVD lists only Exynos 1280 while nine families are affected) means asset inventories relying solely on NVD CPE matching will miss a large portion of the exposed fleet; this is a notable gap defenders should compensate for manually.

An attacker installs a malicious Android application on an Exynos-powered Samsung device, where the app makes crafted system calls to the DPU kernel driver to trigger DMA buffer reallocation under a precise timing condition. The resulting double-free corrupts kernel heap metadata, enabling a use-after-free primitive that can be leveraged for kernel privilege escalation or, at minimum, a kernel panic causing device reboot. No public proof-of-concept exploit has been identified at the time of analysis.