The flaw lies in the fuse_backing_mmap function within the kernel's backing.c file, where a use‑after‑free can trigger memory corruption. An attacker who can trigger the freed memory to be re‑used may be able to compromise local privilege without needing elevated execution rights.

This issue affects devices running the Google Android operating system, specifically those that include the affected kernel common component. No explicit version range is provided in the advisory; the problem exists in any kernel build that has not yet been updated with the corresponding fix.

The exploit requires no user interaction and is limited to a local context, but once a local user gains elevated rights they can fully control the device. Although the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the absence of a need for higher privileges makes it a high‑risk flaw for compromised or malicious local users. The CVSS score is not disclosed in the current data, thus the absolute severity cannot be quantified, but the described impact warrants immediate attention.