Android Kernel CVE-2026-56970

Exploitation requires the attacker to already execute code as a local, unprivileged app on the affected Android/Pixel device (AV:L, PR:N); there is no remote vector. The flaw is a missing permission check in one or more interfaces, so no special product configuration or feature toggle is named - it is present in default builds until patched. No user interaction is required (UI:N). The primary limiting factors are the need for prior on-device code execution and application of the 2026-09-01 Pixel/Android security patch level, which closes the missing check.

The vendor scores this 8.4 (High) with CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning local access only but no privileges and no user interaction, with full C/I/A impact. The impact triad (C:H/I:H/A:H) is generous boilerplate typical of Android bulletin entries - a permission-bypass EoP realistically grants the attacker the privileges of the bypassed component rather than automatically compromising confidentiality, integrity, and availability at High across the board. The genuinely notable metric is PR:N: unlike the many sibling Android EoPs in the same bulletin that require pre-existing System execution privileges (PR:H), this one is exploitable by an unprivileged local app, which is what drives the 8.4. Real-world exploitation signals are low: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing and no public POC identified, so this is not evidence of active or imminent exploitation. No SSVC decision data was provided. Net: a legitimate, patch-worthy local privilege-escalation primitive for defense-in-depth on Android/Pixel, but not an emergency - its severity rests on a genuine unprivileged-local vector, tempered by inflated impact scoring and near-zero exploitation probability. AV:L is consistent with the description ('local escalation of privilege'), so there is no network-vs-local conflict here.

A malicious or compromised app installed on an Android/Pixel device invokes an interface that is missing a permission check, and because no gatekeeping is enforced it performs an action it should not be authorized for, elevating its privileges locally without any user interaction. No public exploit code has been identified. Exploitation is entirely on-device (AV:L) and requires the attacker to already run code as an unprivileged app on the target.