Privilege escalation via DMA transfer use-after-free

Use-after-free in the Android kernel allows attackers to elevate privileges by racing PCIe DMA transfer cleanup against active use. The abc_pcie_issue_dma_xfer_sync function publishes a transfer object in a session before abc_pcie_start_dma_xfer and abc_pcie_wait_dma_xfer finish using it, while abc_pcie_dma_user_xfer_clean can concurrently delete that object. Exploitation requires concurrent access to the same DMA session and can yield elevated privileges through kernel memory reuse.