In the Android kernel, a logic error in several code locations can cause the system to enter a state that prevents it from functioning correctly, resulting in a local denial of service. No additional privileges are needed, and the attack requires no user interaction, meaning an attacker who compromises or controls the device can trigger the failure at any time.

Google’s Android operating system is affected where the common kernel code containing the faulty logic is included. The specific Android versions impacted are not enumerated in the advisory, so all builds that incorporate the vulnerable kernel paths should be considered potentially affected.

The vulnerability can be exploited locally, producing a denial of service that leads to device instability or restarts. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating a lower public exploitation probability. However, because an attacker can trigger the flaw on a compromised device without elevated privileges, the risk remains significant for exposed or shared devices. A local attacker does not need to gain further execution privileges, and no remote attack vector is described in the CVE.