CVEvulnerability

CVE-2025-48623

7.8 HIGH Published 2025-12-08 Modified 2026-10-07 Official page ↗

Status: Modified
Published: 2025-12-08
Last modified: 2026-10-07
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-787

Description

In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected configurations

• google android

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-787 Out-of-bounds Write weakness

References

https://android.googlesource.com/kernel/common/+/3b6fab0ff24f7108c71a4d9c12567455cb2a5a81 Patch, Product
https://android.googlesource.com/kernel/common/+/e76cff4952af4ac4652dc74ffbd134ff57c47895 Patch, Product
https://source.android.com/security/bulletin/2025-12-01 Vendor Advisory

CVE-2025-48623

Description

Affected configurations

Related

Weakness · CWE (2)

References