Android Kernel CVE-2026-55365

Exploitation requires an attacker to already hold System execution privileges (CVSS PR:H) - i.e., code running as the Android System UID or equivalent must be able to reach the remap.c code path. The attacker must be able to supply a crafted offset/length to the remapping function so that the bounds check incorrectly validates it and the write lands out of bounds; successful privilege escalation further depends on the layout of kernel memory adjacent to the target buffer (heap grooming may be needed for reliable control). No user interaction is required (UI:N) and no network access is needed (AV:L). Limiting factors: the high PR:H prerequisite means an unauthenticated remote attacker cannot reach this directly - it is only useful as a post-compromise escalation step, and the attacker must already be local to the device or have a foothold in a System-privileged process.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.7) describes a locally triggered, low-complexity bug that nonetheless requires high privileges (PR:H - System execution privileges) before it can be reached. This is a classic privilege-escalation-from-System posture: an attacker who already controls a System-privileged process uses the OOB write to break out into full kernel/root context, so the flaw is a post-compromise escalation step rather than a remote entry point. Exploitation status: no public exploit identified at time of analysis (no POC, not in KEV), so this is not currently a mass-exploitation concern. EPSS data was not supplied, but given the local-only, high-PR prerequisite the realistic exploitation probability for an unauthenticated outsider is low; the residual risk is significant for chained device-compromise scenarios. Note that the CVSS score (6.7, Medium) may understate the impact of a full kernel compromise in environments where System privileges are already obtainable through a separate bug - defenders should treat it as a chained-exploit enabler.

An attacker who already runs code in a System-privileged process (for example by chaining a separate lower-bug) calls the vulnerable remap interface in remap.c with a malformed offset or length, causing the kernel to write past the intended buffer. The out-of-bounds write corrupts an adjacent kernel object, letting the attacker overwrite credential or function-pointer data and elevate from System to full root/kernel control without any user interaction.