Android SDK: Ten Linux Kernel Vulnerabilities Patched in Single Disclosure Event
Ten Linux kernel vulnerabilities impacting the Android SDK were disclosed and patched on September 24, 2026, addressing critical flaws in error handling and memory management.
Key findings
- Ten Linux kernel vulnerabilities disclosed on September 24, 2026, affecting diverse subsystems.
- Fixes target issues like error handling, memory management, and file system integrity.
- Two vulnerabilities, CVE-2026-97520 and CVE-2026-97438, are rated High severity (CVSSv3 7.1).
- All vulnerabilities were patched on the same day, indicating a swift response.
- These patches are crucial for the security and stability of the Android SDK and devices.
On September 24, 2026, a coordinated disclosure event brought to light ten vulnerabilities within the Linux kernel, a core component of the Android SDK. These issues, all patched on the same day, span various subsystems and address critical flaws including error handling, memory management, and data integrity. The timely patching of these vulnerabilities is crucial for maintaining the security and stability of Android devices.
Several vulnerabilities relate to memory management and error handling. CVE-2026-97512 in the spi:spi-qcom-qspi driver addresses incomplete error handling during runtime power management, which could lead to inconsistent system states. Similarly, CVE-2026-97407 in ASoC:rockchip:rockchip_pdm corrects a failure to handle runtime PM resume errors, preventing further hardware access issues. CVE-2026-97506 in crypto:ixp4xx resolves a buffer chain unwind issue on allocation failure, preventing null pointer dereferences. CVE-2026-93215 in cdx fixes a double-free vulnerability that could occur when sysfs file creation fails.
Other vulnerabilities touch upon file system integrity and configuration. CVE-2026-97439 and CVE-2026-97438, both affecting fs/ntfs3, address issues related to preserving non-DOS attribute bits and validating index entry key bounds, respectively. These could lead to corrupted file system images or directory lookup failures. CVE-2026-97520 in gfs2 involves moving an iterator increment to improve explicit progression. CVE-2026-97475 in thermal/drivers/tegra/soctherma switches to devm for cooling device registration, simplifying resource management. CVE-2026-93263 in clk:eswin addresses zero-initialization of stack-allocated clk_init_data to prevent potential issues. Finally, CVE-2026-93241 in memcg aims to bypass reclaim and the OOM killer for dying tasks once the OOM reaper is done, addressing long-standing job exit path issues.
The disclosure, which also included 15 other vulnerabilities across different Linux kernel subsystems, was highlighted by Vypr Intelligence. While no specific threat actors or in-the-wild exploitation were mentioned in relation to this specific batch of ten CVEs, the sheer volume and variety of issues underscore the ongoing security efforts required for the Linux kernel. The vulnerabilities range in severity, with CVE-2026-97520 and CVE-2026-97438 noted as High severity with a CVSSv3 score of 7.1.
All ten vulnerabilities were resolved on the same day, indicating a swift response from the kernel developers. Users of the Android SDK, and by extension Android devices, benefit from these patches which enhance system stability and security. The fixes are integrated into the kernel, and users should ensure their devices receive regular system updates to incorporate these security enhancements.
This batch of ten vulnerabilities, disclosed simultaneously, highlights the complexity and continuous maintenance required for a system as fundamental as the Linux kernel. While these specific issues were addressed promptly, the ongoing discovery of vulnerabilities across various subsystems serves as a reminder of the importance of vigilant security practices and timely updates for all users. The focus on error handling, memory safety, and file system integrity in this batch demonstrates the kernel's commitment to robust security.