CVE-2025-36922
📋 TL;DR
This CVE describes a use-after-free vulnerability in the bigo_map function of bigo_iommu.c in the Android kernel. It allows local attackers to disclose sensitive information and potentially escalate privileges to kernel level without user interaction. The vulnerability affects Android devices, particularly Google Pixel phones.
💻 Affected Systems
- Google Pixel phones
- Android devices using affected kernel
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains kernel-level privileges, potentially compromising the entire device, accessing all data, and establishing persistence.
Likely Case
Local information disclosure leading to privilege escalation within the device, allowing access to sensitive kernel memory.
If Mitigated
Limited impact if device is fully patched, has SELinux enforcing mode, and runs with minimal kernel attack surface.
🎯 Exploit Status
Exploitation requires local access and kernel knowledge; no user interaction needed but requires system execution privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: December 2025 Android Security Patch or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2025-12-01
Restart Required: Yes
Instructions:
1. Apply December 2025 Android security patch via Settings > System > System update. 2. Reboot device after update completes. 3. Verify patch level in Settings > About phone > Android version.
🔧 Temporary Workarounds
Disable vulnerable kernel module
linuxRemove or disable the bigo_iommu kernel module if not required
rmmod bigo_iommu
Enable SELinux enforcing mode
linuxEnsure SELinux is in enforcing mode to limit kernel exploitation impact
setenforce 1
getenforce
🧯 If You Can't Patch
- Restrict physical access to devices and implement application allowlisting
- Monitor for suspicious kernel module loading and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check kernel version and security patch level: Settings > About phone > Android version > Build numberCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level includes December 2025 or later in Settings > About phone📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux denials related to bigo_iommu
- Unexpected kernel module loading
Network Indicators:
- None - this is a local kernel vulnerability
SIEM Query:
source="android_kernel" AND ("bigo_iommu" OR "use after free" OR kernel_panic)