The vulnerability CVE-2026-0125 affects multiple functions in the vpu_ioctl.c component of Google Android. It arises from a race condition that leads to a use-after-free scenario, enabling local privilege escalation. Exploitation does not require user interaction or elevated execution privileges. The vulnerability is published but lacks a CVSS score and official remediation details. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow a local attacker to elevate their privileges on an affected Android device. This could lead to unauthorized access or control over system resources. Since no additional execution privileges or user interaction are required, the vulnerability poses a risk of privilege escalation in local attack scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided by the vendor at this time.