A critical vulnerability in the Android kernel allows an attacker to escalate privileges locally without requiring user interaction or elevated permissions.

The flaw exists within the __host_check_page_state_range function of mem_protect.c, where an incorrect bounds check results in an out of bounds write. This vulnerability permits a local attacker to achieve elevation of privilege without requiring any special user interaction or pre-existing execution privileges.

The potential for local privilege escalation poses a severe risk to device integrity, as it grants an attacker full control over the affected system. Given the CVSS score of 8.4, this vulnerability is classified as High, reflecting the significant threat to data confidentiality, integrity, and system availability. Successful exploitation could allow unauthorized actors to bypass security boundaries, access sensitive user data, or install persistent malware.

Immediate Action: Review the March 2026 Android Security Bulletin and apply the kernel patches provided by your device manufacturer or upstream provider immediately.

Proactive Monitoring: Monitor system logs for unusual kernel-level activity or signs of unauthorized process elevation that may indicate an exploitation attempt.

Compensating Controls: Ensure that security-hardened configurations, such as SELinux, are strictly enforced to limit the potential impact of a local exploit.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk to the Android ecosystem. Administrators and users must prioritize the deployment of the March 2026 security updates to address the underlying flaw in the kernel memory protection logic. Failure to patch leaves the device susceptible to local exploitation, which could lead to full system compromise.