Google Pixel Kernel EUVD-2026-79000

Exploitation requires local code execution already at Android System privilege level on an affected Pixel device - the description states 'System execution privileges needed,' so this is not reachable by an ordinary unprivileged app. No user interaction is required once System context is held. The trigger is reaching the gmc_phy_lp3_exit_restore_registers routine in the PHY power driver (phy_power.c) with input that exceeds the unchecked buffer bound. Limiting factors: local vector only (no remote/network reach), the high pre-existing privilege requirement, and the Pixel-specific driver scope, which together constrain this to use as a later stage in an exploit chain rather than an initial-access primitive.

This is a local privilege escalation in the Pixel-specific kernel PHY power driver (gmc_phy_lp3_exit_restore_registers in phy_power.c), rooted in a missing bounds check (CWE-120 buffer overflow). The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) marks it local, low-complexity, no user interaction, with full CIA impact - consistent with kernel-level EoP. However, the description explicitly states 'local escalation of privilege with System execution privileges needed,' meaning the attacker must ALREADY hold Android System-level privileges to reach the vulnerable code; this argues for PR:H rather than the vendor's PR:L, lowering the practical severity (my assessed vector yields ~6.7). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation. Realistically this is a defense-in-depth kernel hardening fix relevant to a chained exploit (a System-context process escaping to kernel), not a standalone remote or unprivileged threat - moderate priority, patch via monthly Pixel update cycle.

An attacker who has already achieved code execution in an Android System-privileged context (e.g., via a prior bug or a malicious privileged component) invokes the vulnerable PHY power-management path, supplying data that overflows a buffer because the bounds check is missing, corrupting kernel memory to escalate from System to kernel privileges. No user interaction is required. No public exploit code was identified at time of analysis.