CVE-2026-0029
Published: 02 March 2026
Summary
CVE-2026-0029 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the logic error in __pkvm_init_vm by identifying, reporting, and applying available kernel patches to prevent memory corruption and privilege escalation.
Implements memory protection controls to prevent unauthorized reads, modifications, or deletions exploited by the kernel memory corruption vulnerability.
Enforces least privilege to restrict the impact of local privilege escalation resulting from improper privilege management in the vulnerable kernel function.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption in Android kernel directly enables privilege escalation without prior access or interaction.
NVD Description
In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2026-0029 is a memory corruption vulnerability caused by a logic error in the __pkvm_init_vm function of pkvm.c within the Android kernel. This flaw affects Android devices utilizing vulnerable versions of the common kernel codebase.
A local attacker requires no additional execution privileges and no user interaction to exploit the vulnerability, enabling escalation of privilege. Successful exploitation grants high-impact confidentiality, integrity, and availability compromises, as indicated by the CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-269 (Improper Privilege Management).
Mitigation patches are available in the Android kernel common repository via commits 42eff3b2fd3a906ac8cdb6284d3265bc0856b56b, 749cf1743eb22eff1851c68a533147e1af97a9bf, and ae242b26371808a221578b89c937568781719d2c. Additional details on affected versions and vendor-specific updates appear in the Android Security Bulletin dated 2026-03-01.
Details
- CWE(s)