CVE-2025-36922: Android Kernel Information Disclosure via Use After Free in bigo_map
Summary
CVE-2025-36922: In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-12-05. Fixed in Pixel-family specific:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android operating system, specifically within the kernel's memory management subsystem. This subsystem is responsible for managing memory allocation and deallocation, ensuring efficient use of system resources. The vulnerability arises in the 'bigo_map' function of 'bigo_iommu.c', which is critical for handling input/output memory management. Given the kernel's role in managing system resources, any vulnerabilities can have severe implications for system security and stability.
Vulnerability Detail
In the 'bigo_map' function of 'bigo_iommu.c', a use after free vulnerability exists, which can lead to information disclosure. This occurs when memory that has already been freed is accessed, potentially allowing an attacker to read sensitive data from the memory. The vulnerability can lead to local escalation of privilege, meaning that a user with limited access could gain higher-level permissions within the operating system. Exploitation does not require user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
Pixel-family specific:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to update to the fixed version as soon as it becomes available.
Conclusion
CVE-2025-36922 represents a significant security risk within the Android kernel due to a use after free vulnerability. Users are strongly encouraged to update their devices to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36922 is a vulnerability in the Android kernel that allows for information disclosure due to a use after free error in the 'bigo_map' function.
This vulnerability can potentially allow an attacker to escalate privileges on the device, gaining unauthorized access to sensitive information and system resources.
No, exploitation of this vulnerability does not require any user interaction, making it more critical.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating your device as soon as the patch is available to protect against potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
