Android status [LWN.net]

Android status

Posted May 11, 2026 9:21 UTC (Mon) by jpfrancois (subscriber, #65948)
Parent article: Dirty Frag: a zero-day universal Linux LPE

What is the effect of this on Android ?
I have the impression that new kernel deployment are much less frequent on phones than they are on Linux Distro.
What will be the effect of these new vuln on android ?
Does it mean easier rooting tool (I don't know how easy it is to gain root on current phone).
What about malware apps ? Will they become easier to make du to the abundance of unpatched kernel vulnerability on Android kernel ?

to post comments

Android status

Posted May 11, 2026 12:59 UTC (Mon) by MarcB (subscriber, #101804) [Link]

Android is very unlikely to be affected. Android uses SELinux in way that is far beyond what generic Linux distributions do. They basically went with a "deny everything, then selectively allow" approach.

You can have a look at git clone https://android.googlesource.com/platform/system/sepolicy, in particular private/app_neverallows.te.

# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
# ioctl permission, or 3. disallow the socket class.
neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
neverallow all_untrusted_apps *:{
socket netlink_socket packet_socket key_socket appletalk_socket
netlink_tcpdiag_socket netlink_nflog_socket
netlink_xfrm_socket netlink_audit_socket
netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
netlink_rdma_socket netlink_crypto_socket sctp_socket
ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
} *;

Note that those "neverallow" rules are a fail-safe: Even if some other rules allows one of those things, they will still be denied.