The vulnerability resides in the Linux kernel binder subsystem. When a binder transaction is sent, the offsets array is copied into the target process’s virtual memory area (VMA) and then read back for interpretation. Normally the VMA is read‑only, preventing tampering, but if an attacker can grant write access to its own VMA, it can alter the offsets before the kernel re‑reads them. This race condition, a classic Time‑of‑Check to Time‑of‑Use flaw, can cause the kernel to misinterpret the intended transaction and, under certain payload shapes, allow the receiving process to gain privileges over the sender. The weakness matches CWE‑824 (Improper Synchronization) and CWE‑362 (Atomicity Violation).

Affectation is limited to Linux kernel implementations; no specific version ranges were supplied in the official disclosure. The patch that removes the unsafe read was integrated into the kernel via commit 3672141c93b7a0c0132bf5d5021a4b7f1d663aaa and subsequent related commits. Administrators should verify that their kernel contains these commits or is at a later release that includes the fix.

The CVSS score is not listed, and the EPSS rating is unavailable. The vulnerability is not recorded in the CISA KEV catalog, indicating no known recent exploitation. Exploitation requires an attacker to first obtain the ability to write to a read‑only VMA, which normally needs another binder or kernel flaw to be combined. Because of these prerequisites, the likelihood of successful exploitation is moderate to low, but the impact is high if an attacker can chain this flaw with a second vulnerability to achieve privilege escalation.