Android Kernel EUVD-2026-115386

Requires local code execution on the affected device: the attacker must be able to run unprivileged code (for example a malicious or compromised application) that drives the kernel into the fault-around page-fault handling path in do_fault_around. Per the CVSS vector (AV:L/PR:N/UI:N) no prior privileges and no user interaction are needed once such code runs, but there is NO remote or network exploitation path - the local-access requirement is the key limiting factor. Exploitation is bounded to Android kernels covered by the 2026-11-01 bulletin; the exact triggering steps and vulnerable configuration are not described in the available sources.

This is a genuine but not emergency-grade priority. The CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects total compromise impact, but the attack vector is explicitly LOCAL - there is no network reachability, so an attacker must already be able to run unprivileged code on the device (e.g. a malicious or compromised app) before this use-after-free in do_fault_around can be reached. The signals are internally consistent: CISA SSVC lists Exploitation: none, Automatable: no, and Technical Impact: total, matching a high-impact local privilege-escalation primitive that is not trivially mass-exploitable. The vuln.today decision label is 'this_week', i.e. patch promptly but not an act_now/emergency item. Not in CISA KEV, and no public exploit was identified at time of analysis. No EPSS score was provided in the input, so exploitation probability cannot be weighed here; this is a data gap rather than a low score. The main caveat: CVSS AC:L and the 'logic error' description suggest reliable triggering, but the sources do not describe the actual trigger mechanism, so real-world exploit reliability on a given kernel/device is unverified.

A malicious or compromised app running on the device with no special privileges triggers the page-fault-around code path in the kernel's memory manager, exercising the use-after-free in do_fault_around to corrupt kernel memory and escalate from an unprivileged context toward root/kernel privileges. No user interaction is required. No public exploit was identified at time of analysis.