Google Android Pixel MFC driver out-of-bounds write in __mfc_handle_released_buf

#!/usr/bin/env bash
# check-cve-2026-0116.sh
# Purpose: Determine likely exposure to CVE-2026-0116 on Google Pixel devices.
# Logic: Pixel devices missing security patch level 2026-03-05 are treated as VULNERABLE.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

TARGET_PATCH="2026-03-05"
SERIAL="${1:-}"

fail_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

adb_cmd() {
  if [[ -n "$SERIAL" ]]; then
    adb -s "$SERIAL" "$@"
  else
    adb "$@"
  fi
}

command -v adb >/dev/null 2>&1 || fail_unknown "adb not found in PATH"

STATE="$(adb_cmd get-state 2>/dev/null || true)"
[[ "$STATE" == "device" ]] || fail_unknown "no reachable adb device"

getprop_safe() {
  adb_cmd shell getprop "$1" 2>/dev/null | tr -d '\r'
}

MODEL="$(getprop_safe ro.product.model)"
BRAND="$(getprop_safe ro.product.brand)"
PATCH="$(getprop_safe ro.build.version.security_patch)"
RELEASE="$(getprop_safe ro.build.version.release)"
DEVICE="$(getprop_safe ro.product.device)"
HARDWARE="$(getprop_safe ro.hardware)"
SOC_MANUF="$(getprop_safe ro.soc.manufacturer)"
BOARD="$(getprop_safe ro.board.platform)"

[[ -n "$MODEL" ]] || fail_unknown "unable to read device model"
[[ -n "$PATCH" ]] || fail_unknown "unable to read security patch level"

# Normalize likely Google Pixel scope.
IS_PIXEL=0
if [[ "$BRAND" =~ [Gg]oogle ]] || [[ "$MODEL" =~ Pixel ]]; then
  IS_PIXEL=1
fi

if [[ $IS_PIXEL -ne 1 ]]; then
  echo "UNKNOWN: non-Pixel or unrecognized device model ('$BRAND $MODEL'); manual review required"
  exit 2
fi

# Heuristic family match for supported Pixel generations likely carrying the gs/Tensor stack.
AFFECTED_FAMILY=0
if [[ "$MODEL" =~ Pixel\ (6|6a|6\ Pro|7|7a|7\ Pro|8|8a|8\ Pro|9|9a|9\ Pro|9\ Pro\ XL|9\ Pro\ Fold|10|10a|10\ Pro|10\ Pro\ XL|10\ Pro\ Fold|Fold) ]]; then
  AFFECTED_FAMILY=1
fi

# Basic date comparison works because Android patch levels are YYYY-MM-DD.
if [[ "$PATCH" < "$TARGET_PATCH" ]]; then
  if [[ $AFFECTED_FAMILY -eq 1 ]]; then
    echo "VULNERABLE: $BRAND $MODEL | Android $RELEASE | Patch $PATCH | device=$DEVICE | hw=$HARDWARE | soc=$SOC_MANUF | board=$BOARD"
    exit 1
  else
    echo "UNKNOWN: Pixel device with patch level $PATCH older than $TARGET_PATCH, but model family is not in the expected affected set: $MODEL"
    exit 2
  fi
fi

echo "PATCHED: $BRAND $MODEL | Android $RELEASE | Patch $PATCH | device=$DEVICE | hw=$HARDWARE | soc=$SOC_MANUF | board=$BOARD"
exit 0