Researchers Find Android Kernel's 'Random' Memory Layout Isn't Random at All

Security researchers at Google's Project Zero have uncovered a weakness in how the Linux kernel used in Android phones handles memory layout randomisation. This randomisation, known as KASLR (Kernel Address Space Layout Randomisation), is designed to make it harder for attackers to exploit software bugs by hiding where key parts of the kernel sit in memory.

While investigating kernel exploitation on Google Pixel devices, the researchers found that a specific memory region, called the linear mapping, was supposed to be randomised on every boot. In practice, this hasn't happened for some time on arm64 devices, and a kernel code change confirmed that randomisation of this memory region is no longer a supported feature at all. This means an attacker with the right access could predict this part of memory without needing to steal information to work out its location first, removing a step that would normally make exploitation harder.

This finding matters because KASLR is one of the built in protections that limits the damage a hacker can do even after finding a software flaw. If this protection is silently not functioning as intended, exploit developers have an easier path to turning bugs into working attacks on affected devices.

Key Takeaway: Businesses should ensure Android devices are kept fully updated, as manufacturers and Google will need to patch this kind of underlying weakness before it can be properly mitigated.