Physical privilege escalation via Epoll callback use-after-free

Use-after-free in Android 11's init runtime allows physically proximate attackers to execute code with elevated permissions. The Epoll callback list retained callback references without shared ownership, allowing a callback object to be freed before later use. Physical access to the device is required, but no prior execution privileges or user interaction are needed; successful exploitation gains additional permissions.