---
id: "CVE-2026-70387"
kind: "vulnerability"
aliases: ["CVE-2026-70387"]
title: "OnePlus OxygenOS: logging HAL lets root-level callers run arbitrary shell commands"
severity: "high"
cvss: 8.4
epss: 0.00128
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["android", "mobile-fleet", "oneplus", "oxygenos", "vendor"]
not_affected_if: ["non-oneplus-device", "patched-build"]
published_at: "2026-10-21T09:17:07+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:01:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70387", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-70387", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# OnePlus OxygenOS: logging HAL lets root-level callers run arbitrary shell commands

The olc2 logging HAL on OnePlus OxygenOS exposes a binder method that runs a caller-supplied command through /vendor/bin/sh, and it only checks that the caller is uid 0. A process that reaches root in one of the allowed SELinux domains, such as dumpstate reached from an unprivileged app, can run arbitrary commands in a context holding all Linux capabilities.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Settings > About phone > check the OxygenOS version; the affected builds are 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000
- unknown for any other method of checking the olc2 HAL on a device

## Fix

- Update OxygenOS to `16.1.10.500` or later on the 16.1 line, `16.0.5.1200` or later on the 16.0 line, or `15.0.0.2000` or later on the 15.0 line
- unknown for a vendor-side mitigation if the device cannot be updated

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-70387
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-70387

## From the sources

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_