In the Android kernel's mem_protect.c component, a logic flaw permits an out‑of‑bounds write that corrupts kernel memory. The corruption can be controlled by a local actor to gain privileged execution, effectively elevating their privileges from ordinary user to kernel level. This vulnerability is classified as a local privilege escalation and is identified as CWE‑269 and CWE‑787.

The flaw is present in the Android operating system kernel code shipped by Google. No specific Android release or kernel version has been identified in the advisory, implying that any device running the unpatched mem_protect.c implementation is vulnerable. The vulnerability affects all Android devices that use the affected kernel without the official security update.

The CVSS score of 7.8 indicates a high severity for a local vulnerability. The EPSS score is below 1%, suggesting that exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog and requires no user interaction, meaning a local attacker with code execution capabilities can execute the exploit automatically once the device is compromised.