A vulnerable integer calculation in the Android Linux kernel can result in an out‑of‑bounds write. This kernel bug allows a local user to modify memory that should be protected, elevating privileges without needing any additional execution rights or user interaction.

The flaw exists in the Android kernel commonly used on Google devices. No specific kernel versions are listed, but it applies to all Android installations that include the affected code paths.

Exploitability is local and requires the user to be logged on the device; there is no network or remote component. Because the CVSS score is not disclosed, the precise severity cannot be stated. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers with access to the device can leverage the kernel overflow to gain elevated privileges immediately, without any additional access controls being bypassed.