CVE-2025-26418 AI-generated analysis

platform/packages/services/Car, CarDevicePolicyService (car admin / device policy)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

Adds a MANAGE_USERS-or-INTERACT_ACROSS_USERS permission check to CarDevicePolicyService.setUserDisclaimerAcknowledged and a matching @RequiresPermission annotation on CarDevicePolicyManager. Callers without either permission can no longer have the car service acknowledge the new-user disclaimer.

Root cause

ICarDevicePolicyService.setUserDisclaimerAcknowledged(int userId) in service/src/com/android/car/admin/CarDevicePolicyService.java did not check the caller's permissions. For any userId the caller passed in, it set the internal disclaimer status to NEW_USER_DISCLAIMER_STATUS_ACKED, cancelled the user disclaimer notification and called DevicePolicyManager.acknowledgeNewUserDisclaimer() through the car service's own context (mContext.createContextAsUser(user, 0)). Per index search, DevicePolicyManagerService.acknowledgeNewUserDisclaimer itself requires canManageUsers or INTERACT_ACROSS_USERS. That check applies to the car service as the caller, so other apps could acknowledge the disclaimer indirectly through the car service. The commit message describes this as 'previously allowed other apps to call it indirectly'.

How the fix works

• service/src/com/android/car/admin/CarDevicePolicyService.java:setUserDisclaimerAcknowledged: calls a new private enforcePermission() as its first statement, before any state change, notification cancellation or DPM call.
• service/src/com/android/car/admin/CarDevicePolicyService.java:enforcePermission (new): calls mContext.checkCallingOrSelfPermission for MANAGE_USERS and for INTERACT_ACROSS_USERS. If neither is PERMISSION_GRANTED, it throws SecurityException("Requires MANAGE_USERS or INTERACT_ACROSS_USERS permissions"). Per index search, this is the same permission set that DevicePolicyManagerService.acknowledgeNewUserDisclaimer enforces.
• car-lib/src/android/car/admin/CarDevicePolicyManager.java:setUserDisclaimerAcknowledged(UserHandle): adds @RequiresPermission(anyOf = {MANAGE_USERS, INTERACT_ACROSS_USERS}). This is an annotation only and adds no runtime check in the client library.
• One commit touching two files: 16 lines added, none removed.

Completeness

• Covers the Binder entry point setUserDisclaimerAcknowledged.
• The sibling Binder method setUserDisclaimerShown(int userId) in the same file still has no permission check (lines 215-218 of the post-fix code). In the code shown, it only writes the internal disclaimer status via setUserDisclaimerStatus. It does not call DPM or cancel notifications.
• The check only tests for the two permissions. It does not check that userId is a valid user, and it does not limit which user a caller holding either permission may target.
• The material does not show whether the AIDL interface or SELinux also restricts who can reach ICarDevicePolicyService.

Behavior changes

• Callers of CarDevicePolicyManager.setUserDisclaimerAcknowledged or ICarDevicePolicyService.setUserDisclaimerAcknowledged that hold neither MANAGE_USERS nor INTERACT_ACROSS_USERS now get a SecurityException over Binder, and the disclaimer is not acknowledged.
• Callers holding either permission see no change.
• The new @RequiresPermission annotation on the @hide method may produce lint warnings for callers that lack the permission.

Per major

• Android 14: same fix: commit 6afaae7b4be4 in android-security-14.0.0_r28 (Cherrypick-From 275d46a39674, Change-Id Ic4b8ed6037a0ca6fe5d7bc8faf74d3b33eb49a27). All 8 patched lines are present at android-security-14.0.0_r29.
• Android 15: same fix: commit 20d4c410ce12 in android-security-15.0.0_r16. The service change is identical. The manager hunk differs only because 15's CarDevicePolicyManager has no @AddedInOrBefore(majorVersion = 33) line there. All 8 lines are present at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin (Android 16 is not listed). The patched region (all 8 lines) is present at android-security-16.0.0_r8.
• Android 17: same fix: commit 91c7ed0c3871 in android-17.0.0_r1 (base). All 8 lines are present at android-security-17.0.0_r1.

Unknowns

• Why the bulletin does not list Android 16 even though the patched region is present at android-security-16.0.0_r8.
• Whether the Car Settings caller holds one of the required permissions on all affected builds.
• Whether access to ICarDevicePolicyService is otherwise restricted (SELinux, Car API gating) in the affected releases.
• Whether other methods in CarDevicePolicyService call DevicePolicyManager using the service's identity (the full file is not shown).

Back to June 2026 · Findings