A high-severity use-after-free vulnerability in the Android kernel allows unprivileged local attackers to escalate privileges and gain full system control.

The vulnerability exists in the fpc_tee_hal.c source file where a logic error triggers a use-after-free condition. This flaw can be exploited by a local attacker with no additional execution privileges or user interaction to achieve local escalation of privilege.

A successful exploit grants an attacker elevated privileges on the device, potentially bypassing security boundaries to access sensitive user data, modify system configurations, or install persistent malware. With a CVSS score of 8.4, this vulnerability represents a significant threat to device integrity and confidentiality, particularly in enterprise environments where managed Android devices are used to access corporate resources.

Immediate Action: Monitor official Google security bulletins for the release of kernel patches and apply the latest Android security update as soon as it becomes available for your specific device hardware.

Proactive Monitoring: Review system logs for unusual crashes or instability related to the fingerprint or TEE (Trusted Execution Environment) components, which may indicate attempted exploitation.

Compensating Controls: Ensure that device management policies are strictly enforced, such as limiting physical access to devices and maintaining robust endpoint detection and response solutions where supported.

Public Exploit Available: No

Given the potential for complete system compromise via local privilege escalation, this vulnerability carries substantial risk. Administrators should prioritize the deployment of the forthcoming security updates provided by Google or the relevant OEM. Until a patch is applied, ensure that devices are protected by up-to-date security software and that unauthorized local access to devices is strictly controlled.