CVE-2025-36920 Details
Description
In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
A vulnerability has been identified in the KVM hypervisor component for ARM64 architecture, specifically in the memory allocation file of the NVHE (Non-Vectorized Hypervisor Extension) implementation. The issue arises from inadequate input validation, allowing for a potential out-of-bounds write. This vulnerability could be exploited to escalate privileges locally, without requiring any additional execution rights or user interaction.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 | CISA-ADP | Vendor Advisory |
| https://source.android.com/security/bulletin/pixel/2026-03-01 | [email protected] | Vendor Advisory |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| google android | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |