CVE-2025-48638

Description

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

PUBLISHED Reserved 2025-05-22 | Published 2025-12-08 | Updated 2025-12-09 | Assigner google_android

Problem types

Elevation of privilege

Product status

References

android.googlesource.com/...308cf65c84109c08d06b01950dcd57fe

android.googlesource.com/...70d67df5072afa2ce84622f5a0ff552a

source.android.com/security/bulletin/2025-12-01

cve.org (CVE-2025-48638)

nvd.nist.gov (CVE-2025-48638)

Download JSON