I need help in understanding Android security patch level. I am running Android 7.1.2 in an IMX.7 board. That is the maximum version supported by my h/w.

From the NVD vulnerability database, running CPE name search against cpe:/:google:android:7.1.2 results in 1214 vulnerabilities, published from 2010 to 2021. The current security patch level of my android is 2017-05-05 which will fix most of vulnerabilities published earlier to 2017. The 2019-10-01 android security bulletin link says it fixes vulnerabilities for 7.1.1, 7.1.2. So is it possible to update my android security patch level to 2019-10-01, so that I can eliminate the vulnerabilities (not all but most) before Oct, 2019.

But I also found from this page, the max security patch level for android-7.1.2_r39(last Nougat release) is 2017-10-01. And I also found the code change for vulnerabilities listed in 2019-10-01 security bulletin are missing in android-7.1.2_r39. So this means 7.1.2 security patch level cannot be updated to 2019-10-01 or Fixes in 2019-10-01 are not implemented in android-7.1.2_r39? I lack understanding on android releases and security patch levels & would like the help from the community.

  • 3
    Based on my understanding, the security patch has been merged to the AOSP 7.1.2 codebase. However, to update the security patch means that someone needs to build a ROM based on that codebase for your device (e.g. the official Lineage OS for Nexus 5 stopped at Android 7.1.2, with security patch 2018-12-5).
    – Andrew T.
    Commented Nov 1, 2021 at 7:52
  • anything can be patched
    – alecxs
    Commented Nov 1, 2021 at 8:09
  • In the end the answer is the same as for this question: android.stackexchange.com/questions/226636/…
    – Robert
    Commented Nov 1, 2021 at 8:51


You must log in to answer this question.

Browse other questions tagged .