CVE-2021-39793
Published 2022-03-16 · Updated 2026-06-17 · Source security@android.com
Summary
CVE-2021-39793 is a high-severity (CVSS 7.8) vulnerability in Google Pixel. CISA added it to the Known Exploited Vulnerabilities catalog on April 11, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 2, 2022. CISA does not currently list it as used in ransomware campaigns. Google has 76 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 76 known-exploited Google vulnerabilities →Description
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Google — Pixel
Name: Google Pixel Out-of-Bounds Write Vulnerability
Date added: 2022-04-11 · Due: 2022-05-02
Required action: Apply updates per vendor instructions.