The vulnerability lies in the pkvm_init_vm function within the Android pkvm module, where a logic error can cause memory corruption due to insufficient authorization checks (CWE-269). This flaw allows a local attacker to achieve privilege escalation without requiring any additional execution privileges or user interaction. The resulting compromise grants the attacker higher system privileges, potentially enabling full control of the device.

Google Android kernels that include the pkvm module and have not yet received the fix from recent commits. The vulnerability applies to all Android devices running the affected kernel version.

The CVSS score of 8.4 indicates a high severity. The EPSS score of less than 1% suggests that, while the flaw is serious, its likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation does not require network access or user interaction, meaning any local user or malicious application can trigger the memory corruption by invoking the pkvm_init_vm routine.