The vulnerability is a race condition in the arm_lpae_split_blk_unmap function of the Android kernel's io-pgtable-arm-common.c module. It can corrupt memory when concurrent threads unmap page table blocks. An attacker who can execute code locally on the device could exploit this to gain higher privileges, potentially allowing arbitrary modification of system services or access to protected data. The flaw does not require additional privileges or user interaction to trigger, meaning any local user can attempt the attack.

The issue affects Android devices that run the kernel containing the io-pgtable-arm-common.c component with the vulnerable arm_lpae_split_blk_unmap implementation. Specifically, Google Android releases prior to the fix cited in the 2026-11-01 security bulletin. Devices using older kernel versions that have not applied the patch are at risk. No specific OS version was enumerated in the vendor notes, so any device running a legacy kernel is likely impacted until updated.

The CVSS score is not listed, but the EPSS is unavailable, and the vulnerability is not in the KEV catalog, indicating no known widespread exploitation yet. However, because the flaw requires only local access and no additional execution privileges, and it can be triggered by a race condition without user interaction, the risk of exploitation remains high for any device that is locally accessed by an attacker. The attack vector is inferred to be local, likely via a malicious app or privileged process that manipulates memory mapping calls. Regular patches and updates are needed to mitigate this risk.