What it is
The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- android.googlesource.com/platform/system/vold/+/c51920c82463b240e2be0430849837d6fdc5352e
- nvd.nist.gov/vuln/detail/CVE-2011-1823
Description and required action as published by CISA. Full record at NVD.
Other Android entries on the list
- Framework Android Framework Integer Overflow Vulnerability CVE-2025-48595 · Jun 2, 2026
- Framework Android Framework Information Disclosure Vulnerability CVE-2025-48633 · Dec 2, 2025
- Framework Android Framework Privilege Escalation Vulnerability CVE-2025-48572 · Dec 2, 2025
- Runtime Android Runtime Use-After-Free Vulnerability CVE-2025-48543 · Sep 4, 2025
- Framework Android Framework Privilege Escalation Vulnerability CVE-2024-43093 · Nov 7, 2024
- Kernel Android Kernel Remote Code Execution Vulnerability CVE-2024-36971 · Aug 7, 2024