{"id":"CVE-2026-55297","kind":"vulnerability","aliases":["CVE-2026-55297"],"related":[],"title":"Android kernel: race in TIPC virtio driver bypasses memory tagging","description":"In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"A race condition in the handle_chan_msg function of the Linux TIPC virtio driver (tipc_virtio_dev.c) lets concurrent modification of shared memory bypass memory tag access controls. An attacker with System-level execution can use it to escalate privileges locally, and no user interaction is needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","kernel","tipc"],"not_affected_if":["no-tipc-virtio"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:12+00:00","first_seen_at":"2026-11-10T20:46:05+00:00","triaged_at":"2026-11-10T20:54:08+00:00","updated_at":"2026-11-10T20:54:08+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:54:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android kernel: race in TIPC virtio driver bypasses memory tagging","impact":"high","summary":"A race condition in the handle_chan_msg function of the Linux TIPC virtio driver (tipc_virtio_dev.c) lets concurrent modification of shared memory bypass memory tag access controls. An attacker with System-level execution can use it to escalate privileges locally, and no user interaction is needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","kernel","tipc"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker escalates privileges past memory tag protections","analyst_note":"Confirm affected Android kernel versions and the patch level that fixes CVE-2026-55297 from the Android security bulletin or NVD.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tipc-virtio"],"who_is_affected":"The sources describe a local privilege escalation requiring System-level execution privileges in the TIPC virtio driver, so exposure is limited to devices running the affected kernel. The sources do not name the affected Android or kernel versions, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4549,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-55297':13A,16A 'access':48B,87C 'android':1A,17B 'attack':51B 'bypass':8A,45B,84C 'chan':27B,72C 'concurr':40B,90C 'condit':23B,98C 'control':49B,88C 'could':100C 'cve':11A,14A 'dev.c':38B,77C 'driver':7A,35B 'due':94C 'escal':61B,104C 'execut':56B,109C 'exploit':118C 'function':29B 'handl':26B,71C 'infrastructur':18B 'interact':67B,113C 'kernel':2A,19B 'lead':101C 'let':39B 'level':55B 'linux':32B 'local':63B,103C 'memori':9A,44B,46B,85C,92C 'modif':41B,93C 'msg':28B,73C 'need':69B,111C,116C 'possibl':81C 'privileg':62B,106C,110C 'race':3A,22B,97C 'share':43B,91C 'system':54B,108C 'system-level':53B 'tag':10A,47B,86C 'tipc':5A,20B,33B,36B,75C 'use':58B 'user':66B,112C 'via':89C 'virtio':6A,34B,37B,76C 'way':82C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a local privilege escalation requiring System-level execution privileges in the TIPC virtio driver, so exposure is limited to devices running the affected kernel. The sources do not name the affected Android or kernel versions, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","kernel","tipc","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-55297':13A,16A 'android':1A 'bypass':8A 'cve':11A,14A 'driver':7A 'kernel':2A 'memori':9A 'race':3A 'tag':10A 'tipc':5A 'virtio':6A","search_b":"'access':48B 'android':17B 'attack':51B 'bypass':45B 'chan':27B 'concurr':40B 'condit':23B 'control':49B 'dev.c':38B 'driver':35B 'escal':61B 'execut':56B 'function':29B 'handl':26B 'infrastructur':18B 'interact':67B 'kernel':19B 'let':39B 'level':55B 'linux':32B 'local':63B 'memori':44B,46B 'modif':41B 'msg':28B 'need':69B 'privileg':62B 'race':22B 'share':43B 'system':54B 'system-level':53B 'tag':47B 'tipc':20B,33B,36B 'use':58B 'user':66B 'virtio':34B,37B","search_c":"'access':87C 'bypass':84C 'chan':72C 'concurr':90C 'condit':98C 'control':88C 'could':100C 'dev.c':77C 'due':94C 'escal':104C 'execut':109C 'exploit':118C 'handl':71C 'interact':113C 'lead':101C 'local':103C 'memori':85C,92C 'modif':93C 'msg':73C 'need':111C,116C 'possibl':81C 'privileg':106C,110C 'race':97C 'share':91C 'system':108C 'tag':86C 'tipc':75C 'user':112C 'via':89C 'virtio':76C 'way':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55297","severity":null,"published_at":"2026-11-10T20:19:12+00:00","modified_at":"2026-11-10T20:19:12+00:00","first_seen_at":"2026-11-10T20:46:05+00:00","fetched_at":"2026-11-10T20:46:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}