Android pKVM mem_protect integer overflow leading to out-of-bounds write

#!/usr/bin/env bash
# check-cve-2026-0028.sh
# Determine likely exposure to CVE-2026-0028 on an Android device via adb.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/adb failure

set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "Usage: $0 <adb-serial>"
  exit 3
fi

SERIAL="$1"
ADB=(adb -s "$SERIAL")

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN"
  echo "Reason: adb not installed"
  exit 2
fi

if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "UNKNOWN"
  echo "Reason: device not reachable via adb"
  exit 2
fi

getprop_safe() {
  "${ADB[@]}" shell getprop "$1" 2>/dev/null | tr -d '\r'
}

shell_safe() {
  "${ADB[@]}" shell "$1" 2>/dev/null | tr -d '\r'
}

PATCH_LEVEL="$(getprop_safe ro.build.version.security_patch)"
ABI_LIST="$(getprop_safe ro.product.cpu.abilist64)"
ARCH="$(shell_safe 'uname -m')"
SDK="$(getprop_safe ro.build.version.sdk)"
MODEL="$(getprop_safe ro.product.model)"
VIRT_APEX="$(shell_safe 'pm path com.android.virt >/dev/null 2>&1; echo $?')"
HYP_TRACE="$(shell_safe 'if [ -d /sys/kernel/tracing/hypervisor ] || [ -d /sys/kernel/debug/tracing/hypervisor ]; then echo yes; else echo no; fi')"
KVM_DEV="$(shell_safe 'if [ -e /dev/kvm ]; then echo yes; else echo no; fi')"

# Compare dates lexicographically because Android patch levels are YYYY-MM-DD.
FIXED_DATE="2026-03-05"

is_arm64=no
if [[ "$ARCH" == "aarch64" ]] || [[ "$ABI_LIST" == *"arm64"* ]]; then
  is_arm64=yes
fi

pkvm_signal=no
if [[ "$VIRT_APEX" == "0" ]] || [[ "$HYP_TRACE" == "yes" ]] || [[ "$KVM_DEV" == "yes" ]]; then
  pkvm_signal=yes
fi

echo "Model: ${MODEL:-unknown}"
echo "SDK: ${SDK:-unknown}"
echo "Arch: ${ARCH:-unknown}"
echo "Patch level: ${PATCH_LEVEL:-unknown}"
echo "AVF APEX present: ${VIRT_APEX:-unknown} (0 means present)"
echo "Hypervisor tracefs present: ${HYP_TRACE:-unknown}"
echo "/dev/kvm present: ${KVM_DEV:-unknown}"

if [[ -z "$PATCH_LEVEL" ]]; then
  echo "UNKNOWN"
  echo "Reason: unable to read security patch level"
  exit 2
fi

if [[ "$PATCH_LEVEL" > "$FIXED_DATE" || "$PATCH_LEVEL" == "$FIXED_DATE" ]]; then
  echo "PATCHED"
  echo "Reason: device patch level is ${PATCH_LEVEL}, which is >= ${FIXED_DATE}"
  exit 0
fi

if [[ "$is_arm64" != "yes" ]]; then
  echo "PATCHED"
  echo "Reason: device is not ARM64; pKVM/AVF protected mode is ARM64-focused and this CVE is not expected to apply"
  exit 0
fi

if [[ "$pkvm_signal" == "yes" ]]; then
  echo "VULNERABLE"
  echo "Reason: ARM64 device below ${FIXED_DATE} with virtualization/pKVM indicators present"
  exit 1
fi

echo "UNKNOWN"
echo "Reason: device is below ${FIXED_DATE}, but pKVM/AVF presence could not be confirmed without deeper OEM-specific inspection"
exit 2