The BigWave hardware driver on the Pixel 9 SOC, accessible from the mediacodec SELinux context, contains three vulnerabilities discovered through code auditing. The most critical is a use-after-free (UAF) bug caused by a race condition between the ioctl BIGO_IOCX_PROCESS call and the bigo_worker_thread processing jobs. When the ioctl times out waiting for job completion, it dequeues the job and returns to userland. If the file descriptor is closed at this point, the kernel struct 'inst' containing the job is freed while the worker thread may still access it, leading to UAF and arbitrary kernel read/write capabilities. This bug allows sandbox escape from mediacodec to kernel privilege escalation on Pixel 9 devices. The vulnerabilities were publicly disclosed and fixed on January 5, 2026.

Successful exploitation of the use-after-free vulnerability in the BigWave driver allows an attacker to escape the mediacodec sandbox and gain arbitrary kernel read and write capabilities on the Pixel 9 device. This results in local privilege escalation, potentially enabling full control over the device kernel and bypassing security restrictions intended by the sandbox. The other two bugs discovered also contribute to the overall risk but are less detailed in the provided information.

Fixes for all three vulnerabilities in the BigWave driver were made available on January 5, 2026. Users and administrators should apply the official patches provided by the vendor to remediate these issues. Since this is a local privilege escalation vulnerability in device drivers, updating the Pixel 9 device firmware or operating system to the patched version is the recommended mitigation. No alternative mitigations are described in the advisory.