{"id":"CVE-2026-56916","kind":"vulnerability","aliases":["CVE-2026-56916"],"related":[],"title":"Trusty kernel: race in virtqueue buffer handling allows local privilege escalation","description":"In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A time-of-check/time-of-use race in the Trusty kernel's virtqueue code (trusty/kernel/lib/trusty/vqueue.c) lets a local process read a value twice with different results. The description says this can lead to privilege escalation on the device.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Trusty","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","infrastructure","linux-kernel","trusty"],"not_affected_if":["no-local-code-execution"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","triaged_at":"2026-11-10T20:53:50+00:00","updated_at":"2026-11-10T20:53:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:53:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Trusty kernel: race in virtqueue buffer handling allows local privilege escalation","impact":"high","summary":"A time-of-check/time-of-use race in the Trusty kernel's virtqueue code (trusty/kernel/lib/trusty/vqueue.c) lets a local process read a value twice with different results. The description says this can lead to privilege escalation on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["trusty","android","linux-kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local code escalates privileges on the device","analyst_note":"Find affected Trusty versions, device builds and the vendor fix from the NVD entry or the Android security bulletin; the sources given do not state them.","how_to_check":"unknown","plain_action":"","product_name":"Trusty","needs_analyst":true,"not_affected_if":["no-local-code-execution"],"who_is_affected":"The sources describe a local attacker with execution privileges on a device running the Trusty secure OS kernel, which is typically found in Android phones and tablets. The sources do not list affected versions or whether specific devices are impacted, so teams cannot tell from the description alone whether they run it. Users who cannot run code locally are not described as exposed.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4562,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-56916':14A,17A '/time-of-use':30B 'allow':8A 'android':19B 'avail':66C 'buf':67C 'buffer':6A 'check':29B 'code':38B 'condit':83C 'could':85C 'cve':12A,15A 'descript':52B 'devic':62B 'differ':49B 'doubl':76C 'double-read':75C 'due':79C 'escal':11A,59B,89C 'execut':93C 'exploit':100C 'get':65C 'handl':7A 'infrastructur':20B 'interact':97C 'kernel':2A,23B,35B 'lead':56B,86C 'let':40B 'linux':22B 'linux-kernel':21B 'local':9A,42B,88C 'lock':68C 'need':95C 'possibl':74C 'privileg':10A,58B,91C,94C 'process':43B 'race':3A,31B,82C 'read':44B,77C 'result':50B 'say':53B 'time':27B 'time-of-check':26B 'toctou':78C 'trusti':1A,24B,34B 'trusty':18A 'trusty/kernel/lib/trusty/vqueue.c':39B,70C 'twice':47B 'user':96C 'valu':46B 'virtqueu':5A,37B 'vqueue':64C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a local attacker with execution privileges on a device running the Trusty secure OS kernel, which is typically found in Android phones and tablets. The sources do not list affected versions or whether specific devices are impacted, so teams cannot tell from the description alone whether they run it. Users who cannot run code locally are not described as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["trusty"],"ptokens":["trusty"],"labels":["android","infrastructure","linuxkernel","trusty","unknown","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-56916':14A,17A 'allow':8A 'buffer':6A 'cve':12A,15A 'escal':11A 'handl':7A 'kernel':2A 'local':9A 'privileg':10A 'race':3A 'trusti':1A 'trusty':18A 'virtqueu':5A","search_b":"'/time-of-use':30B 'android':19B 'check':29B 'code':38B 'descript':52B 'devic':62B 'differ':49B 'escal':59B 'infrastructur':20B 'kernel':23B,35B 'lead':56B 'let':40B 'linux':22B 'linux-kernel':21B 'local':42B 'privileg':58B 'process':43B 'race':31B 'read':44B 'result':50B 'say':53B 'time':27B 'time-of-check':26B 'trusti':24B,34B 'trusty/kernel/lib/trusty/vqueue.c':39B 'twice':47B 'valu':46B 'virtqueu':37B","search_c":"'avail':66C 'buf':67C 'condit':83C 'could':85C 'doubl':76C 'double-read':75C 'due':79C 'escal':89C 'execut':93C 'exploit':100C 'get':65C 'interact':97C 'lead':86C 'local':88C 'lock':68C 'need':95C 'possibl':74C 'privileg':91C,94C 'race':82C 'read':77C 'toctou':78C 'trusty/kernel/lib/trusty/vqueue.c':70C 'user':96C 'vqueue':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56916","severity":null,"published_at":"2026-11-10T20:19:15+00:00","modified_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","fetched_at":"2026-11-10T20:46:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}