An issue in the Android kernel function __pkvm_guest_relinquish_to_host causes an out‑of‑bounds write when invalid input is processed. This flaw can be exploited locally without the need for additional privileges, allowing an attacker to crash the kernel and force a device reboot. The vulnerability has no remote exploitation surface and does not provide any execution capabilities, but it can disrupt service and compromise availability for the affected system.

The flaw affects the Android operating system kernel on devices running any Android version where the protected memory management subsystem is present. The vendor responsible is Google. Specific vulnerable releases are not enumerated in the provided data.

The CVE lacks CVSS or EPSS metrics, and it is not listed in the CISA KEV catalog. Nonetheless, the local denial of service risk exists because no user interaction is required and the attack can be carried out from a compromised application or shell. The exploit does not grant elevated privileges, but repeated crashes could impact device availability and reliability, making it a moderate to high risk in environments where uptime is critical.