CVE-2026-0137 - In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free

Back Back to CVE browser

HIGH

In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free

Published Jun 16, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.07%

Description

In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor Google Product Android Default
unaffected
Affected
- Android kernel

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Google	Android	unaffected	Affected Android kernel

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37171
Advisory
https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37171		Advisory
https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Google_Devices

Published Jun 16, 2026

Updated Jun 17, 2026

Reserved Oct 23, 2025

Link CVE-2026-0137

CISA Vulnrichment

Updated Jun 16, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-0137

Red Hat

No data

ENISA EUVD

Assigner Google_Devices

Published Jun 16, 2026

Updated Jun 17, 2026

Link EUVD-2026-37171

GitHub

No data