Android Kernel EUVD-2026-115587

Exploitation requires the attacker to already be able to run local code on the device (a malicious or compromised unprivileged app) and to reach the FUSE backing passthrough code path that invokes fuse_backing_mmap in backing.c; the device/kernel build must include and expose that FUSE backing functionality. No additional execution privileges and no user interaction are needed once local code runs. The principal limiting factor is the local attack vector (AV:L): the flaw is not remotely reachable and cannot be triggered over the network, so a separate initial-access step (installing or compromising an app) is a prerequisite. The exact conditions that free-then-reuse the object are not described in the available sources.

This is a genuine but second-tier priority: a CWE-416 use-after-free in fuse_backing_mmap (backing.c) of the Android common kernel yielding local privilege escalation. The provided CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) signals a local-only but high-impact flaw - no privileges and no user interaction needed once code runs on the device, with total loss of confidentiality, integrity and availability. The SSVC framework tempers this: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local vector that cannot be sprayed at scale), while Technical Impact is 'total' (consistent with a kernel-level compromise). The signals are therefore internally consistent rather than conflicting: high technical impact but constrained reach. It is NOT in CISA KEV and no public exploit is referenced, so this is not confirmed active exploitation. EPSS was not provided in the input, so probability of exploitation cannot be quantified here - do not assume low or high. The vendor priority label is 'this_week', which fits a high-severity local kernel EoP that should be patched promptly but is not an emergency given AV:L and no evidence of exploitation. Note the PR:N rating: it reflects that any unprivileged on-device process can trigger it, not that the flaw is remotely reachable - an attacker still needs prior local code execution.

A malicious or compromised unprivileged Android app running on the device interacts with the FUSE backing code path to trigger the use-after-free in fuse_backing_mmap, corrupting kernel memory and escalating to kernel/root privileges without any user interaction. No public exploit or PoC is identified in the provided data, and the exact trigger is not described in the available sources. Exploitation is local only - it presupposes the attacker can already execute code on the device.