Emui EUVD-2026-21838

The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U) indicates a local attack with low complexity and no user interaction required, making exploitation straightforward once an attacker has local access. The moderate CVSS score of 5.9 reflects the local-only attack vector; however, the impact spans confidentiality (C:L), integrity (I:L), and availability (A:L), affecting all three security properties. Since no public exploit code or KEV status confirmation is provided, real-world exploitation risk is currently constrained to scenarios where an attacker already has local code execution (e.g., a malicious app). The true risk depends on whether the kernel module is accessible from unprivileged user space; if so, any installed application could trigger the UAF. Without active exploitation confirmation or public POC, this should be prioritized based on the device ecosystem's exposure and whether local app sandboxing can be circumvented.

An attacker with local access to the device (e.g., via a malicious app installed with user consent or a compromised user-space process) triggers the use-after-free condition in the kernel module, causing the freed memory to be reallocated for attacker-controlled data. By carefully timing the re-allocation, the attacker reads kernel memory to leak sensitive information (ASLR bypass, credential data) or modifies kernel structures to escalate privileges or disable security features. A second variant could cause a kernel panic by dereferencing the dangling pointer, achieving a local denial of service.