Android Kernel CVE-2026-55307

Exploitation requires the attacker to already execute code with System privileges (PR:H) directly on the affected Pixel/Tensor device and to reach the kdn_set_sysregs_prot routine in the hwcrypto-kdn.c hardware-crypto driver; it cannot be triggered remotely or over a network (AV:L). No user interaction is needed (UI:N) and no special non-default configuration is called out. The limiting factors are significant: the high pre-existing privilege requirement and local-only access mean this is only reachable after a prior compromise or on devices where untrusted code can obtain System execution, and the impact is confined to confidentiality (information disclosure) with no integrity or availability effect.

This is a genuine-but-low-priority issue, not a high-CVSS crisis - the CVSS base score is 4.4 (Medium), which already reflects the heavily constrained attack surface. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and the description agree: exploitation is local only and requires System execution privileges (PR:H), so an attacker must already hold a highly privileged position on the device before the logic error in kdn_set_sysregs_prot yields any confidentiality gain (C:H, with no integrity or availability impact). All signals point the same direction with no major conflict: SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', consistent with a local info-disclosure primitive rather than a remotely weaponizable flaw. There is no KEV listing and no POC referenced, so this is best treated as a routine monthly-bulletin hardening fix. Note the one scope tension: the CPE is the broad cpe:2.3:a:google:android:*, yet the only reference is the Pixel-specific security bulletin and the affected code (hwcrypto-kdn.c) is a Pixel/Tensor hardware-crypto driver - the real exposure is almost certainly Pixel/Tensor devices rather than all Android. EPSS was not provided in the input.

Malicious code already running with System-level privileges on a Pixel/Tensor device (e.g., a compromised privileged service or a chained prior escalation) invokes the vulnerable kdn_set_sysregs_prot path in the hardware-crypto driver. Because of the logic error, it reads back protected register/key-related state it should not see, disclosing sensitive information locally. No public exploit identified at time of analysis, and no user interaction is required (UI:N).