Local Escalation of Privilege in ARM64 KVM Hypervisor by Android

CVE-2025-36920

What is CVE-2025-36920?

An out of bounds write vulnerability has been identified in the ARM64 KVM hypervisor, specifically in the hyp_alloc function. This issue arises from inadequate input validation, which could potentially allow an attacker to escalate privileges locally. No additional execution privileges are required for exploitation, and user interaction is not necessary. An attacker may exploit this flaw to gain unauthorized access or control over system resources, highlighting the importance of patching systems running affected Android versions.

References