A critical local privilege escalation vulnerability exists in the Android kernel, posing a significant risk of unauthorized system control.

This flaw involves an out-of-bounds write within the __pkvm_load_tracing function due to improper input validation. The vulnerability can be triggered by a local attacker with low privileges to achieve privilege escalation without requiring user interaction.

The ability for a local attacker to escalate privileges to a higher level of authority poses a severe threat to the integrity and confidentiality of the device. Given the CVSS score of 7.8, this vulnerability allows an attacker to bypass standard security boundaries, potentially leading to full system compromise, unauthorized data access, and persistent control over the affected device.

Immediate Action: Apply the latest Android security bulletin updates provided by Google or the specific device manufacturer as soon as they become available.

Proactive Monitoring: Review system logs for unusual kernel activity or unauthorized attempts to access restricted memory regions and sensitive kernel functions.

Compensating Controls: Ensure that device security policies are strictly enforced, including the restriction of unverified applications that could serve as an initial entry point for a local attacker.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Organizations and individual users should prioritize the deployment of the December 2025 Android security updates to remediate this kernel-level flaw. Because this vulnerability allows for elevation of privilege without user interaction, prompt patching is essential to prevent potential exploitation by malicious local actors or compromised applications.