CVE-2018-9385: In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check.

Security readout for executives and security teams

CVE-2018-9385 is an Android kernel flaw where a bounds-checking mistake could allow memory to be written outside the intended area. The known impact is local privilege escalation, but exploitation requires existing System-level execution privileges. There is no source evidence here of active exploitation. Exposure is most relevant to Android devices running affected kernel code and lacking the applicable vendor security update. Risk is lower for attackers without local System-level execution, but important where compromised privileged apps, supply-chain issues, or device fleet patch gaps exist. Treat this as a patch-compliance issue for Android fleets, not an internet-facing emergency. Prioritize devices with outdated security patch levels or environments where System-level compromise is plausible. Mitigation focus: Check Android or device-vendor guidance for CVE-2018-9385 coverage.; Verify devices include the relevant June 2018 or later security update.; Prioritize managed Android devices with stale kernel patch levels..

Prepared

Jun 6, 2026, 22:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.