CVE-2026-0029 - Vulnerability Analysis
HighCVSS: 8.4Last Updated: March 3, 2026
pkvm - Privilege Escalation
Published: March 2, 2026Updated: March 3, 2026
Overview
pkvm contains a logic error in __pkvm_init_vm function causing possible memory corruption, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
Severity & Score
Severity: High
CVSS Score: 8.4
Impact
Local attackers can escalate privileges due to memory corruption without needing extra execution privileges.
Mitigation
Update to the latest version containing the fix.
References
- https://source.android.com/security/bulletin/2026-03-01
- https://android.googlesource.com/kernel/common/+/42eff3b2fd3a906ac8cdb6284d3265bc0856b56b
- https://android.googlesource.com/kernel/common/+/749cf1743eb22eff1851c68a533147e1af97a9bf
- https://android.googlesource.com/kernel/common/+/ae242b26371808a221578b89c937568781719d2c
Related Resources
Details
- CVE ID
- CVE-2026-0029
- Severity
- High
- CVSS Score
- 8.4
- Type
- undefined
- Status
- confirmed
CWE
- CWE-269
CVSS Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H