A race condition in the Android VPU driver’s vpu_open_inst function can trigger a use‑after‑free pointer, allowing an attacker on the same device to gain elevated privileges without requiring additional execution rights or user interaction. The flaw stems from improper memory management in a concurrent environment, as identified by CWE‑362 and CWE‑416.

This vulnerability impacts Android devices running the Google Android operating system, as indicated by the CPE snake string and vendor list. No specific subsystem or version range is provided, so the flaw is presumed to affect all builds that include the affected VPU driver until a patch is applied.

The CVSS score of 7.4 implies a high severity for local escalation. The EPSS score of less than 1% suggests that exploitation is unlikely to be widespread or automated, and the vulnerability is not listed in the CISA KEV catalog. Exploitation does not require network or user‑initiated action; a malicious application or script able to invoke the vulnerable ioctl would be sufficient.