Android Kernel CVE-2026-56960

Exploitation requires the target to be running an affected Android/Pixel build with the vulnerable kernel code present (fixed by the 2026-09-01 Pixel security bulletin patch level). Per the CVSS vector (AV:N/PR:N/UI:N), no authentication and no user interaction are required, and the description explicitly states no additional execution privileges are needed. The practical limiting factors are: the attacker must be able to reach the vulnerable kernel code path (the specific reachable interface/subsystem is not named in the available data), the device must be unpatched below the September 2026 patch level, and successful UAF exploitation must defeat Android kernel memory-corruption mitigations (KASLR, allocator hardening, CFI), which raises real-world exploitation difficulty above the AC:L rating.

The vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects Google's high-severity 'remote escalation of privilege' classification for a kernel use-after-free (CWE-416). Notably, unlike the many local Android EoPs in the same September 2026 Pixel bulletin, this one is scored network-vector, unauthenticated, no-user-interaction, which - if the vector is accurate - makes it a genuinely serious remotely-reachable memory-corruption bug. However, the C:H/I:H/A:H triad is Google's boilerplate for privilege escalation and likely overstates a single UAF's direct impact; a remote EoP that hands an attacker elevated code execution can plausibly justify high impact, so this is defensible rather than clearly inflated. Counter-signals temper urgency: EPSS is only 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code has been identified, indicating this is currently a theoretical/unexploited high-severity issue rather than an actively-abused one. The description's 'multiple locations' phrasing and lack of a specific subsystem make the exact reachable surface hard to verify - confirm the affected component and whether AV:N truly means over-the-network (e.g., Bluetooth/Wi-Fi/baseband/media) versus Google's looser use of 'remote' with the vendor. Net: high-priority to patch on Pixel/Android given the potential for unauthenticated remote privilege escalation, but not an emergency based on current exploitation telemetry.

An attacker within reach of a vulnerable Android/Pixel device sends crafted input that triggers a use-after-free in the affected kernel path, corrupting freed memory to hijack control flow and gain elevated privileges without any user interaction or prior authentication. No public proof-of-concept has been identified, and with AV:N/AC:L the vendor assesses exploitation as low-complexity, though reliable UAF weaponization on hardened Android kernels typically requires bypassing modern memory mitigations.