The vulnerability is a use-after-free bug located in several functions of base.c. The flaw arises from a race condition that can cause an object to be freed while a concurrent path still references it. An attacker already present on the device can exploit this flaw to gain higher privileges without needing any additional execution rights. The impact is a local escalation of privilege that could allow an unprivileged user to perform privileged operations system-wide, potentially compromising data confidentiality and integrity .

Google Android systems that include the vulnerable Android kernel branches mentioned in the Google source repositories. The exact affected kernel versions are not specified, but the issue originates in the shared code present in the common kernel repository referenced by the advisory URLs. Devices running Android versions built from these kernel sources are susceptible.

The flaw is locally exploitable and does not require user interaction. While the EPSS score is not available, the absence of an EPSS value suggests no publicly known exploitation data yet. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread attacks. However, because a local exploit can lead to full privilege escalation, the risk remains high for any device that is compromised by malware or malicious local users. The primary attack vector is an attacker with local access, which is a common scenario for rooted or jailbroken devices or after a successful malware infection.