The vulnerability resides in the removeUserData method of DevicePolicyManagerService.java. A race condition allows a user with local execution privileges to trigger a denial‑of‑service condition. The flaw does not require user interaction, so an attacker with user rights can repeatedly invoke the operation to exhaust system resources, leading to unresponsive or crashed services. The weakness aligns with the race condition guideline, where concurrent state changes produce unexpected outcomes.

Affected product is Google Android devices that include the DevicePolicyManagerService implementation. No specific version range is disclosed, so any installation that contains the current Android framework where removeUserData is present is potentially impacted. Organizations deploying enterprise device management should verify whether their device builds include this flaw.

The CVSS score is not supplied in the public advisory, and the EPSS score is unavailable, so the exact severity cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user execution privileges but no special user interaction, meaning any local user could induce the DoS. The lack of remote activation limits the impact to the affected device, but repeated failures could disrupt device management functions and degrade availability for users.