The kernel function __pkvm_pages_to_ppages in mmu.c can suffer an out‑of‑bounds write due to a race condition. An attacker who can execute code on the device can exploit this flaw to overwrite kernel memory, thereby gaining higher privileges without needing additional execution rights. The vulnerability does not require user interaction and can be triggered locally by competing processes.

Android devices using the Google kernel common branch are affected; specific Android releases and kernel versions are not listed in the advisory, so affected builds must be determined by checking Google’s security bulletin or source release notes.

Because this flaw allows local privilege escalation, the exploitation risk is high for users who can run code on the device, such as installed applications or rooted users. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the absence of these metrics does not negate the severity of a local elevation. The likely attack vector involves a race condition that an attacker can trigger by manipulating concurrent memory operations, resulting in kernel memory corruption.