The flaw resides in smmu_detach_dev within arm-smmu-v3.c, where a use‑after‑free can cause an out‑of‑bounds write. An attacker with local access can exploit this without any user interaction to raise privileges to system level, enabling full control over the device.

All Android devices that run the Linux kernel subset incorporating the SMMU v3 driver. This applies to every Android release version before the issue is patched, regardless of vendor.

The CVSS score is 6.7, indicating moderate severity, and the EPSS is less than 1 %, showing that public exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local; the attacker does not need to interact with a user, so any locally‑present process can trigger the flaw.