Arbitrary Address Memory Mapping Vulnerability in Android Products by Google
CVE-2026-0106

9.3CRITICAL

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
5 February 2026

What is CVE-2026-0106?

A vulnerability exists in the vpu_mmap function of vpu_ioctl where a missing bounds check can allow for arbitrary address memory mapping. This lapse can lead to local privilege escalation without requiring additional execution privileges. Exploitation does not necessitate user interaction, raising concerns for the overall security of affected Android devices.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Android Android kernel

References

https://source.android.com/security/bulletin/pixel/2026-0...

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.