Android Kernel EUVD-2026-115585

Exploitation requires the attacker to already have local code execution on the device - a malicious or compromised app running in an unprivileged context - since the vector is AV:L (local). No privileges (PR:N) and no user interaction (UI:N) are needed beyond that foothold. The specific trigger is a race condition across multiple functions in the DMA-BUF subsystem (dma-buf.c), so successful exploitation depends on winning a timing window to access freed memory; SSVC Automatable:no indicates this cannot be reliably automated at scale. The precise sequence of DMA-BUF calls and the exact interleaving needed to win the race are not described in the available sources. Limiting factors: local access prerequisite, timing dependency of the race, and that it affects the Android common kernel (so impact depends on which devices ship the vulnerable kernel branch).

This is a genuine, high-priority local privilege escalation in the Android common kernel's DMA-BUF subsystem (dma-buf.c), not an inflated high-CVSS issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes local attack vector with no privileges and no user interaction required, and total confidentiality/integrity/availability impact - consistent with kernel-level use-after-free (CWE-416) leading to full compromise of the device. The SSVC framework qualifies the urgency: Exploitation is rated 'none' (no observed or public exploitation), Automatable 'no' (exploitation cannot be reliably mass-scaled, fitting a timing-dependent race that needs local code execution first), but Technical Impact 'total' (complete kernel takeover once triggered). The vuln.today priority of 'this_week' aligns with that: serious but not a drop-everything emergency. On exploitation signals there is tension worth flagging: no KEV listing and no POC are provided in the input, so there is no public exploit identified at time of analysis; however the CVSS vector lists AC:L (low complexity) while the description explicitly attributes the flaw to a race condition, which normally implies timing-dependent, higher-complexity exploitation - SSVC Automatable:no supports the harder-to-exploit reading, so treat the AC:L rating with caution and verify exploit reliability with Google. EPSS was not provided in the input and so cannot be weighed. Net: real priority for Android fleet patching given total kernel impact, tempered by local-only access requirement and absence of known exploitation.

A malicious or compromised unprivileged app already running on the device repeatedly invokes DMA-BUF operations to win a race in dma-buf.c, freeing a buffer object while another code path still references it, then reclaims the freed memory with attacker-controlled data to corrupt kernel structures. Successful exploitation escalates from an ordinary app sandbox to kernel-level privileges. No public exploit was identified at time of analysis, and exploitation requires local code execution plus winning a timing-sensitive race.