CVE-2019-2215: Android Binder use-after-free allows kernel privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityPublic exploit code, KEV listing and a very high EPSS score make this actively dangerous, though exploitation requires local access or a chained network flaw rather than being remotely reachable on its own.

What it is

CVE-2019-2215 is a use-after-free in binder.c in the Android/Linux kernel that lets a local application escalate privileges to the kernel. It matters because the kernel is the trust boundary on Android and affected Linux distributions, so a successful exploit breaks application isolation entirely. The record does not specify affected kernel or Android version ranges beyond the vendor advisories.

Impact

An attacker gains kernel-level code execution from an unprivileged local application, which typically means full control of the device or host. Confidentiality, integrity and availability are all rated high in the CVSS vector.

Attack surface

Reached locally through the Binder driver; the CVSS vector is AV:L/PR:L/UI:N, so the attacker needs local access with low privileges and no user interaction. Per the description, delivery requires either installing a malicious local application or chaining a separate network-facing vulnerability.

Exploitation

It is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.721 (99.4th percentile), and multiple references are tagged Exploit, indicating public exploit code exists. No ransomware campaign use is documented.

What to do

• Apply the Android security bulletin and vendor kernel updates for the affected Binder code first; prioritize Android devices and any Linux hosts running the affected kernel.
• Track and enforce the CISA KEV remediation due date of 2022-05-03 for any still-unpatched assets.
• Restrict installation of untrusted applications and enforce app-store or allowlist controls to reduce the local delivery path.
• Patch network-facing services that could be chained to deliver the local exploit, since the description notes that route.
• For NetApp and Huawei products listed, apply the respective vendor advisories rather than assuming the Android fix covers them.

Detection

• Monitor for unexpected privilege transitions or kernel crashes/panics originating from Binder ioctl activity on Android or Linux endpoints.
• Hunt for known public exploit artifacts or PoC binaries associated with the Binder use-after-free on managed devices.
• Alert on installation or execution of sideloaded or untrusted applications on Android devices in managed fleets.
• Correlate endpoint telemetry for local privilege escalation attempts against kernel processes with subsequent suspicious kernel-level activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.