Android SDK: 18 Linux Kernel Flaws Patched in Coordinated August 15 Disclosure
Key findings • 18 Linux kernel vulnerabilities impacting Android SDK disclosed on August 15, 2026. • Vulnerabilities span networking, memory management, I/O, filesystem, and graphics subsyste…
Key findings
- 18 Linux kernel vulnerabilities impacting Android SDK disclosed on August 15, 2026.
- Vulnerabilities span networking, memory management, I/O, filesystem, and graphics subsystems.
- Issues include race conditions, use-after-free flaws, deadlocks, and validation errors.
- All disclosed vulnerabilities were patched on the same day as disclosure.
- Users are urged to update to the latest Android SDK versions for security.
On August 15, 2026, a coordinated disclosure event brought to light 18 vulnerabilities within the Linux kernel, a core component of the Android SDK. These issues, patched on the same day, span various subsystems including networking, memory management, I/O, and graphics drivers. The vulnerabilities range in severity and could potentially lead to system instability or denial-of-service conditions.
Networking Vulnerabilities
Several vulnerabilities were found in the networking stack. CVE-2026-74577 in the MPLS subsystem could lead to issues due to uninitialized memory. CVE-2026-74560 addresses a buffer leak in AF_XDP for multi-buffer Tx, inspired by a check from sashiko. CVE-2026-74492 in netfilter: ipset prevents comment corruption from kernel-side hash adds. Additionally, CVE-2026-74572 in octeontx2-af blocks Virtual Functions (VFs) from altering special CGX PKIND state, and CVE-2026-74436 in rxrpc serializes kernel accept preallocation with socket teardown to prevent race conditions.
Memory Management and I/O Vulnerabilities
Memory management and I/O subsystems were also affected. CVE-2026-74576 in mm/slab prevents unbounded recursion in the free path with new kmalloc types. CVE-2026-74573 in thunderbolt addresses a use-after-free in XDomain delayed work on disconnect. CVE-2026-74574 in dmaengine: idxd fixes cleanup failures in idxd_cdev_open(). CVE-2026-74575 in iommu/arm-smmu-v3-iommufd requires exactly one Stream ID for a vDEVICE. CVE-2026-74439 in iommu/vt-d addresses a race condition where the Present bit is cleared before tearing down a scalable-mode context entry. CVE-2026-74438 in crypto: sun4i-ss removes an insecure and unused RNG algorithm due to multiple vulnerabilities. CVE-2026-74478 in um: vector fixes a use-after-free in vector_mmsg_rx(). CVE-2026-74422 in drm/rockchip: inno-hdmi switches to drmm_kzalloc() for proper resource management. Finally, CVE-2026-74350 in ocfs2 validates fast symlink targets during inode reads, and CVE-2026-74342 in kernfs ensures the link to the parent is established before the LSM init hook.
Filesystem Vulnerabilities
Filesystem integrity was also a concern. CVE-2026-74571 in btrfs addresses a NULL pointer dereference when mounting with rescue=ibadroots after corrupting the block group tree root. CVE-2026-74572, also impacting btrfs, fixes a deadlock between metadata writeback and transaction commit in zoned filesystems.
Response and Impact
All 18 vulnerabilities were patched on the same day as their disclosure, August 15, 2026. This coordinated disclosure highlights the vendor's commitment to rapidly addressing security issues. Users of the Android SDK are strongly advised to update to the latest available versions to incorporate these critical patches. The range of affected subsystems indicates a broad impact across the Linux kernel, emphasizing the importance of timely updates.
This batch of vulnerabilities underscores the complexity of the Linux kernel and the continuous effort required to maintain its security. While all issues were patched promptly, the sheer number and diversity of the vulnerabilities suggest ongoing vigilance is necessary. Users should monitor future advisories from Google regarding the Android SDK and its underlying kernel components.