---
id: "CVE-2019-2215"
kind: "vulnerability"
aliases: ["CVE-2019-2215"]
title: "Android Android Kernel: Android Kernel Use-After-Free Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.72105
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Android Android Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "exploited", "infrastructure", "mobile-devices"]
not_affected_if: ["non-android", "patched-device"]
published_at: "2019-10-11T19:15:10+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-2215", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-2215", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2215", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Android Android Kernel: Android Kernel Use-After-Free Vulnerability

A use-after-free bug in the Android kernel's binder.c driver lets an app running on the device escalate its privileges to the Linux kernel. Attackers have used it in the wild, chained with other Android kernel flaws.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Android Android Kernel affected ? fixed ?

## Fix

Apply the Android security patch that addresses CVE-2019-2215 per vendor instructions; the specific patch level is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-2215
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-2215
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-2215

## From the sources

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_