Local privilege escalation via Binder VMA race

Use-after-free in the Android kernel Binder driver allows local users to escalate privileges through a race with munmap without user interaction. binder_update_page_range accesses a cached alloc->vma pointer while munmap can detach and free that VMA under only a read lock. A low-privileged local process can race Binder buffer allocation against VMA teardown, producing kernel memory corruption and privilege escalation.