mem_protect.c out-of-bounds write

## description

An out-of-bounds write in the memory protection subsystem of the Android kernel allows a local attacker to escalate privileges to root.

## impact

Local privilege escalation to root. Full device takeover.

## mitigation

Apply March 2026 security updates.

## proof of concept

// Trigger OOB write in mem_protect
int trigger_oob(void* addr) {
    return syscall(__NR_mem_protect, addr, 0x1000, PROT_READ|PROT_WRITE|PROT_EXEC_OOB);
}

## downloads

## references

• NVD entry