CVE-2026-0163

Name of the Vulnerable Software and Affected Versions Android VPU Driver (affected versions not specified)

Description In multiple functions within vpu ioctl.c, a use-after-free condition exists. Specifically, the VPU IOCX OPEN INSTANCE() and vpu put inst() functions are affected due to the driver instance being removed from an array and the reference counter being reset before the instance is closed. This flaw could allow a remote attacker to escalate privileges without requiring additional execution privileges or user interaction, and may also lead to a denial of service (DoS), which is a condition where the system becomes unavailable to its intended users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.