In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
| Link | Resource |
|---|---|
| https://android.googlesource.com/kernel/common/+/3b6fab0ff24f7108c71a4d9c12567455cb2a5a81 | Patch Product |
| https://android.googlesource.com/kernel/common/+/e76cff4952af4ac4652dc74ffbd134ff57c47895 | Patch Product |
| https://source.android.com/security/bulletin/2025-12-01 | Vendor Advisory |
Configurations
History
08 Dec 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 |
08 Dec 2025, 19:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:google:android:-:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | () https://android.googlesource.com/kernel/common/+/3b6fab0ff24f7108c71a4d9c12567455cb2a5a81 - Patch, Product | |
| References | () https://android.googlesource.com/kernel/common/+/e76cff4952af4ac4652dc74ffbd134ff57c47895 - Patch, Product | |
| References | () https://source.android.com/security/bulletin/2025-12-01 - Vendor Advisory | |
| CWE | CWE-787 | |
| First Time |
Google android
|
08 Dec 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-08 17:16
Updated : 2025-12-08 20:15
NVD link : CVE-2025-48623
Mitre link : CVE-2025-48623
CVE.ORG link : CVE-2025-48623
JSON object : View
Products Affected
- android