CVE-2026-70387: CWE-749 Exposed dangerous method or function in OnePlus OxygenOS

The vulnerability in OnePlus OxygenOS arises from the olc2 logging HAL exposing a binder method that forks and executes a shell command supplied by the caller. The only authorization check is that the caller's UID is 0. Due to SELinux policy granting binder access to multiple client domains, any process running as uid 0 within those domains can invoke this method. Notably, the dumpstate process, which can be reached from an unprivileged app through another vulnerability, can exploit this to execute arbitrary commands. The spawned shell runs in the u:r:vendor_qti_init_shell:s0 SELinux context, which possesses all Linux capabilities, effectively granting full system control. This affects OxygenOS versions from 15.0.0 before 15.0.0.2000, 16.0.0 before 16.0.5.1200, and 16.1.0 before 16.1.10.500.

Successful exploitation allows an attacker with access to a uid-0 process in the affected SELinux domains to execute arbitrary shell commands with full Linux capabilities. This can lead to complete system compromise on affected OnePlus OxygenOS devices. The vulnerability is particularly severe because it can be reached indirectly from an unprivileged app via another vulnerability, expanding the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected binder HAL and monitor for attempts to exploit dumpstate or other uid-0 processes in the affected SELinux domains. Avoid installing untrusted applications that might leverage the related vulnerabilities to escalate privileges.