The vulnerability exists in the ksys_unshare function in the Android kernel. A use‑after‑free condition allows a local user to corrupt kernel memory, which can be leveraged to elevate privileges. The attacker does not require any additional execution privileges or user interaction; simply exploiting the memory corruption can provide higher privileges on the affected system.

Products impacted are Google Android devices running the affected kernel. Specific version information is not disclosed in the advisory, so all Android installations utilizing the vulnerable kernel code are potentially affected.

The CVSS score is not provided, and the EPSS score is unavailable, but the vulnerability can be exploited locally without user interaction, indicating a high exploitation likelihood in environments where the vulnerable kernel is active. The issue is not currently listed in CISA's KEV catalog, suggesting no publicly known exploitation, yet the local privilege escalation capability warrants prompt action.