Android Kernel EUVD-2026-74029

Requires local code execution on the target Android device at a minimum of standard app-level (PR:L) process privileges - any installed app or shell user can attempt exploitation. No user interaction is needed, and no non-default kernel configuration appears required, as the vulnerability exists in core IOMMU functions. Exploitation is constrained to local access (AV:L): remote-only attackers cannot trigger this directly without first achieving local code execution via another vulnerability. SELinux policy in enforcing mode may reduce the attack surface by limiting which processes can invoke the affected IOMMU code paths, though this is not a confirmed mitigation for this specific flaw.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes the real-world risk: a locally-executing app or shell process with ordinary user privileges can reliably trigger the flaw without any special system configuration or user interaction. Attack complexity is low (AC:L), meaning exploitation does not require race conditions or unusual states. The C:H/I:H/A:H triad reflects full kernel compromise. No EPSS score was provided in the input data, and the CVE is not listed in CISA KEV, so widespread automated exploitation is not confirmed. However, local kernel privilege escalation vulnerabilities in Android are consistently valued by exploit developers for use in malware, spyware, and sandbox-escape chains - the low AC makes this particularly useful. Real-world risk is elevated for devices awaiting OEM patch deployment, as Android kernel patches from Google's bulletin typically lag on non-Pixel hardware.

A malicious Android application installed on a target device with standard user-level permissions submits specially crafted inputs to vulnerable IOMMU kernel functions, triggering an out-of-bounds memory write in kernel address space. The corrupted kernel memory is leveraged to overwrite a security-critical structure (such as credentials or a function pointer), escalating the process to root. No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity (AC:L) implies that once the vulnerable code path is understood, a reliable exploit is feasible.