Local privilege escalation via ION reference-count overflow

Use-after-free in the Android kernel allows local users to elevate privileges through the ION memory manager without user interaction. ion_buffer_kmap_get increments the kernel-mapping reference counter without rejecting integer overflow, allowing a freed buffer to remain in use. A local user with ordinary execution access can corrupt kernel memory and gain elevated privileges; no user interaction is required.