CVE-2025-36940 Overview
CVE-2025-36940 is a use-after-free vulnerability in the Zircon kernel pager proxy component of Google's Fuchsia operating system. The flaw allows a local attacker with low privileges to escalate from userspace to kernel context. Successful exploitation grants attackers full control over the affected system, including confidentiality, integrity, and availability of kernel-level resources. The weakness is classified under [CWE-416] Use After Free. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.
Critical Impact
Local userspace code can achieve kernel privilege escalation on Fuchsia systems through the vulnerable pager proxy path, compromising kernel isolation guarantees.
Affected Products
- Google Fuchsia operating system
- Zircon microkernel (pager proxy subsystem)
- Devices and platforms built on Fuchsia
Discovery Timeline
- 2026-08-24 - CVE-2025-36940 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2025-36940
Vulnerability Analysis
The vulnerability resides in the Zircon kernel pager proxy, a subsystem responsible for mediating page requests between userspace pager clients and kernel-managed virtual memory objects (VMOs). A use-after-free condition occurs when the kernel retains or dereferences a pointer to a pager proxy object after it has been freed. Attackers with local userspace access can trigger the dangling reference during pager operations, corrupting kernel memory. This corruption can be shaped into a controlled write primitive, enabling code execution in kernel mode. The result is a full privilege escalation from userspace to the Zircon kernel.
Root Cause
The root cause is improper lifecycle management of pager proxy objects inside Zircon. Object ownership and reference counting between the pager proxy and its associated kernel structures are not synchronized correctly during teardown. When a proxy is released while still referenced by another kernel path, subsequent access dereferences freed memory. [CWE-416] Use After Free vulnerabilities in kernel components are frequently exploitable because attackers can reallocate the freed slab with attacker-controlled data.
Attack Vector
An authenticated local user creates and manipulates pager objects through Zircon syscalls exposed to userspace. By racing or ordering operations against the pager proxy lifecycle, the attacker triggers use of a freed proxy object. The attacker then sprays kernel heap allocations to reclaim the freed slot with controlled data, converting the dangling reference into arbitrary kernel read or write. No user interaction is required beyond initial local access.
No verified public exploit code is available. Refer to the Google Product Documentation for vendor technical details.
Detection Methods for CVE-2025-36940
Indicators of Compromise
- Unexpected kernel panics or Zircon exceptions referencing pager proxy objects or VMO operations.
- Userspace processes making unusual sequences of zx_pager_create, zx_pager_create_vmo, and zx_pager_detach_vmo syscalls.
- Kernel logs showing dangling reference or double-free assertions in pager subsystem code paths.
Detection Strategies
- Enable kernel address sanitizer (KASAN) builds of Zircon in test and staging environments to surface use-after-free access during fuzzing.
- Monitor Fuchsia component crash reports for repeated crashes originating from pager-related kernel stacks.
- Baseline pager syscall usage per component and alert on outlier processes issuing high-frequency pager lifecycle operations.
Monitoring Recommendations
- Forward Fuchsia kernel diagnostic logs and crash reports to a centralized logging pipeline for retention and correlation.
- Track privilege boundary violations and unexpected job or process capability changes on Fuchsia hosts.
- Review software supply chain telemetry for unsigned or unexpected components attempting to invoke pager APIs.
How to Mitigate CVE-2025-36940
Immediate Actions Required
- Apply the Fuchsia platform update containing the Zircon pager proxy fix as referenced in the Google Product Documentation.
- Inventory all Fuchsia-based devices and workloads and prioritize patching systems exposing untrusted local execution.
- Restrict which components hold the capabilities required to create pager objects until patches are deployed.
Patch Information
Google addresses the use-after-free through updates to the Zircon kernel pager proxy object lifecycle handling. Consult the vendor advisory at Google Product Documentation for build identifiers and update instructions specific to your Fuchsia platform release.
Workarounds
- Limit local code execution on Fuchsia devices to trusted, signed components until updates are applied.
- Reduce the capability set granted to userspace components so they cannot invoke pager creation syscalls unnecessarily.
- Enforce component sandboxing policies through Fuchsia's capability routing to constrain reachability of the vulnerable code path.
# Example: verify Fuchsia system version after applying vendor update
ffx target show | grep -i version
ffx component list | grep -i pager
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
