Android Kernel CVE-2026-56906

Requires an attacker to already be executing code locally on the device at low privilege (e.g., an installed/compromised unprivileged app) and to win a timing-sensitive race in the kernel's epoll teardown path (ep_free in eventpoll.c), reclaiming the freed object before the use-after-free is detected. No user interaction is required. Exploitation is LIMITED by: local access only (no remote vector), the need for an existing code-execution foothold (PR:L), and high attack complexity (AC:H) because the race is probabilistic and non-deterministic - reflected in SSVC Automatable='no'. There are no special product configuration prerequisites; the epoll subsystem is present in default Android kernel builds.

This is a legitimate but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) is internally consistent with the description: exploitation is local (AV:L), requires an already-present low-privileged foothold such as an installed app (PR:L), needs no user interaction (UI:N), but is gated by high attack complexity (AC:H) because success depends on winning a kernel race condition (CWE-362) in ep_free. Impact is total (C:H/I:H/A:H), matching the 'local escalation of privilege' outcome and the SSVC Technical Impact of 'total'. The mitigating signals dominate the current risk picture: SSVC Exploitation is 'none' and SSVC Automatable is 'no' (race conditions are inherently probabilistic and hard to reliably automate), there is no CISA KEV listing, and no public exploit was identified. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a data gap, not a low score. There is no conflict between the CVSS vector and the description; both agree on local, authenticated, no-UI privilege escalation. Net: a high-severity local LPE primitive valuable to malware/exploit-chain authors on Android, but not currently evidenced as exploited and difficult to weaponize reliably - patch on the normal prioritized cycle rather than as an emergency.

A malicious or compromised low-privilege Android app repeatedly manipulates epoll file descriptors to race the ep_free cleanup path, triggering a use-after-free in the kernel. By winning the race and reclaiming the freed object, the app corrupts kernel memory to escalate from the app sandbox to kernel/root privileges. No public exploit was identified at time of analysis and no user interaction is required.