In the Android kernel, an error in the function __host_check_page_state_range of mem_protect.c allows an out‑of‑bounds write due to an incorrect bounds check. The flaw is a classic heap or stack buffer overflow (CWE‑787) and can be triggered by a local user without any additional privileges or user interaction. Once triggered, the attacker can overwrite kernel memory, elevate their privileges to root, and consequently manipulate system settings, access confidential data, or disrupt device operation.

The vulnerability affects the Android operating system supplied by Google. No specific kernel version was listed, so all Android kernel builds that include the vulnerable code are potentially impacted.

The CVSS rating of 8.4 indicates a high severity, but the EPSS score of less than 1 % and the lack of listing in the CISA KEV catalog imply a low likelihood of exploitation at present. Attackers would need local access to the device; no remote exploitation path or user interaction is required. The absence of a documented workaround means the only reliable defense is to apply the official security update as soon as it becomes available.