The Android kernel routine __pkvm_load_tracing performs an incorrect bounds check, allowing an out‑of‑bounds write that can corrupt kernel memory and elevate privileges. This flaw aligns with the CWE‑125 out‑of‑bounds write weakness and the CWE‑119 buffer overrun weakness and enables a local attacker to gain higher privileges without needing additional execution rights.

The vulnerability resides in the Android kernel’s PKVM tracing module located in trace.c. It affects any Android device that runs the affected kernel components; specific version information is not provided, so older kernel releases that do not contain the fix are assumed impacted. The vendor is Google and the product line is Android OS.

The flaw is local; an attacker only needs local access to the device and no user interaction beyond normal device use. Successful exploitation permits memory corruption and privileged code execution, effectively providing root level rights. The CVSS score of 8.4 indicates high severity, and the EPSS score of < 1% suggests a very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploit yet. Until the patch is applied any local user can potentially exploit the flaw, making it a critical risk for devices exposed to untrusted local storage or applications.