Android's November security patch does not include fix for critical privilege-escalation bug in Linux kernel; official Linux patch was released last month
November 2016 Lucian Constantin / CIO.com : Android patches fix Drammer RAM attack, but not Dirty Cow exploit Ionut Arghire / SecurityWeek : Google Patches 23 Critical Vulnerabilities in Android Rajesh Pandey / Android Beat : Google Rolls out November Security Update for Pixel and Nexus Devices; Uploads Factory and OTA Images as Well Ryan Whitwam / Android Police : November's Nexus/Pixel factory images and OTA files are now available for download [Update] Andrew Martonik / Android Central : Google posts latest Pixel and Nexus factory images with November security patch Jimmy Westenberg / Android Authority : Google releases November's Android security patch for Pixel and Nexus devices
Context & Ripple Effects
Dirty Cow has been on a slow fuse all year: researchers disclosed the nearly three-year-old Linux kernel privilege-escalation flaw in January (disclosure imperiling PCs, servers, and Android phones) after an earlier round of kernel privilege-escalation patching, and upstream maintainers shipped the official fix last month. Google's September security release patched a related escalation bug but conceded that a large percentage of Android phones were ineligible to receive it.
November's bulletin closes one hole — the Drammer RAM attack — while leaving Dirty Cow unfixed on Android even though the upstream patch exists, making this less a discovery story than a distribution story.
First-order effects
- Pixel and Nexus owners who install the November factory or OTA images get protection against Drammer but remain exposed to Dirty Cow, which lets unprivileged apps gain root on affected kernels.
- Device makers building on the same kernel now have to backport the upstream Linux fix themselves rather than inherit it from Google's bulletin.
Second-order effects
- The gap widens between Google's monthly cadence and the long tail of devices that never receive updates at all — the same eligibility problem flagged when Google shipped its September patch — pushing security burden onto app vendors and carriers.
- Attackers get a clear map: a known, publicly patched kernel exploit that Android still doesn't cover is exactly where mobile exploit kits concentrate next.
Third-order effects
- If upstream fixes keep landing months before they reach Android devices, the structural problem is Android's fork-and-fragment update pipeline, not kernel quality — a pattern the corpus shows repeating as late as the September 2023 zero-day bulletin.
- Sustained exposure to root-level kernel bugs strengthens the case for moving security enforcement out of the OS-update channel entirely — into Play services and hardware-backed mechanisms that reach devices without OEM cooperation.
The trend: Android security is drifting from a kernel-patching model toward platform-level delivery, because the monthly bulletin demonstrably cannot carry upstream Linux fixes to most devices.