CVE Explorer

CVE-2026-0152

In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8699b7e90b7dbe5a55f63c9a5ecab20c1dbd0a493075d62be2c3c85f8f0f534f

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"description":"Elevation of privilege","lang":"en"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/adp/0/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"description":"Elevation of privilege","lang":"en"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/adp/0/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:38d9bfd564680527216251b6d687ebf3631dc756be59cff5d1375d338f3ba6f6 · sha256:e436591f1f72c75d… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer