CVE-2026-28617 AI-generated analysis

platform/packages/modules/Wifi, WifiNetworkSuggestionsManager (network suggestion handling)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

The fix makes WifiNetworkSuggestionsManager clear the vendor data (setVendorData(Collections.emptyList())) on every suggested WifiConfiguration before the suggestion is processed, so app-supplied PersistableBundle vendor data no longer enters the suggestion path that the commit message ties to unbounded XmlUtil (de)serialization.

Root cause

Per the commit message, XmlUtil.writeOuiKeyedDataToXml / readPersistableBundleFromBytes serialize and deserialize PersistableBundle data without limiting nesting depth. WifiNetworkSuggestionsManager accepted the vendor data in a suggestion's WifiConfiguration as-is, even though (per the commit message) setting it on a suggestion was never allowed. Deeply nested vendor data could therefore reach the unbounded (de)serialization. The commit message calls the result a 'persistent DoS'.

How the fix works

• service/java/com/android/server/wifi/WifiNetworkSuggestionsManager.java: the change is in the suggestion add path, in the method that holds the 'bad wifi suggestion from app' check returning STATUS_NETWORK_SUGGESTIONS_ERROR_ADD_NOT_ALLOWED. The hunk header does not show the method name. After that existing check and before convertLegacyFieldsToSecurityParamsIfNeeded, a new loop calls wns.wifiConfiguration.setVendorData(Collections.emptyList()) on every incoming WifiNetworkSuggestion.
• The loop is gated on SdkLevel.isAtLeastV().
• The commit adds import java.util.Collections and changes no other file. XmlUtil is not modified in this commit, even though the commit message names it.

Completeness

• Covers the network suggestion entry point: all vendor data on suggested WifiConfigurations is dropped (on SDK V and later) before further processing.
• Not covered by this commit: XmlUtil.writeOuiKeyedDataToXml / readPersistableBundleFromBytes are unchanged, so this diff does not harden any other path that uses those helpers. The material does not show whether a separate depth-bounding change exists.
• Only the add path is sanitized. The diff contains no migration code, so suggestions persisted with vendor data before the fix are not scrubbed by this change.

Behavior changes

• On SDK V and later, any vendor data in a WifiNetworkSuggestion's WifiConfiguration is silently discarded at add time. The caller gets no error.
• The diff adds no new status codes, timeouts or log messages.

Per major

• Android 14: Not affected: the bulletin does not list Android 14. All 8 lines of the patched region are reported present at android-security-14.0.0_r29.
• Android 15: Same fix: commit 5dab8604e9c0 in android-security-15.0.0_r17, 8/8 lines present.
• Android 16: Same fix: commit 4d8225a6d03d in android-security-16.0.0_r8. The hunk is identical; only the import context differs (java.util.BitSet present). 8/8 lines present.
• Android 17: Same fix: commit 9b1148745f6b in android-security-17.0.0_r1, identical hunk at a shifted line offset, 8/8 lines present.

Unknowns

• Whether a separate commit adds depth bounding to XmlUtil.writeOuiKeyedDataToXml / readPersistableBundleFromBytes, and which tags it landed in.
• What the two Cherrypick-From sources correspond to.
• The exact name of the method containing the hunk (the hunk header does not show it).
• The exact failure mode of the DoS and whether it survives restarts or affects wifi service startup, beyond the commit message's 'persistent DoS' wording.
• Whether WifiConfiguration vendor data exists on SDK levels below V.

Back to September 2026 · Findings