CVE-2021-39793

CVE-2021-39793 is an out-of-bounds write (CWE-787) in the kbase_jd_user_buf_pin_pages function of mali_kbase_mem.c — the Mali GPU kernel driver used in Google Pixel devices — caused by a logic error in the code. A local application or process can trigger the flaw via the GPU driver's user-buffer pinning routine without needing any additional execution privileges or user interaction. Successful exploitation lets the attacker write out of bounds in kernel memory and achieve local escalation of privilege, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). All Google Pixel devices running affected Android kernel builds are affected; the CISA record lists Google/Android as the vendor/product and designates Google Pixel as the affected product. The bug is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-04-11, no public proof-of-concept is known, and EPSS estimates a 0.7% probability of exploitation within 30 days.

What to do: Apply Google's Android security updates on every Pixel device, per CISA's required action to apply updates per vendor instructions; patches were available as of the April 2022 KEV addition, so ensure devices are on an April 2022 or later security patch level (verify in Settings > About phone > Android security update). There is no known workaround, and because exploitation requires local code execution, review apps installed on unpatched devices and prioritize fleet-wide patching for enterprise-managed Pixel fleets.