{"id":"CVE-2026-58680","kind":"vulnerability","aliases":["CVE-2026-58680"],"related":[],"title":"Kernel mailbox power control flaw allows local privilege escalation to system","description":"In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"A precondition check failure in the cpm_mbox.c power control routine lets a permission check be bypassed. An attacker who already runs code locally with System privileges can escalate further.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","kernel","mediatek"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:23+00:00","first_seen_at":"2026-11-10T20:46:09+00:00","triaged_at":"2026-11-10T20:52:02+00:00","updated_at":"2026-11-10T20:52:02+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:52:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Kernel mailbox power control flaw allows local privilege escalation to system","impact":"high","summary":"A precondition check failure in the cpm_mbox.c power control routine lets a permission check be bypassed. An attacker who already runs code locally with System privileges can escalate further.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["android","kernel","mediatek"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local code gains elevated privileges on the device","analyst_note":"Identify the affected product and firmware versions from the NVD entry and the Android security bulletin for this CVE; the cpm_mbox.c path suggests an Android kernel driver.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000642,"input_tokens":4546,"output_tokens":374,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58680':14A,17A 'allow':6A 'alreadi':42B 'android':18B 'attack':40B 'bypass':38B,65C 'check':24B,36B,70C 'code':44B 'control':4A,31B 'could':73C 'cpm':28B,52C,58C 'ctrl':55C 'cve':12A,15A 'due':66C 'escal':9A,50B,77C 'execut':82C 'exploit':91C 'failur':25B,71C 'flaw':5A 'infrastructur':19B 'interact':86C 'kernel':1A,20B 'lead':74C 'let':33B 'local':7A,45B,76C 'mailbox':2A 'mbox':53C 'mbox.c':29B,59C 'mediatek':21B 'need':84C,89C 'permiss':35B,64C 'possibl':63C 'power':3A,30B,54C 'precondit':23B,69C 'privileg':8A,48B,79C,83C 'routin':32B 'run':43B 'sswrp':56C 'system':11A,47B,81C 'user':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","kernel","mediatek","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-58680':14A,17A 'allow':6A 'control':4A 'cve':12A,15A 'escal':9A 'flaw':5A 'kernel':1A 'local':7A 'mailbox':2A 'power':3A 'privileg':8A 'system':11A","search_b":"'alreadi':42B 'android':18B 'attack':40B 'bypass':38B 'check':24B,36B 'code':44B 'control':31B 'cpm':28B 'escal':50B 'failur':25B 'infrastructur':19B 'kernel':20B 'let':33B 'local':45B 'mbox.c':29B 'mediatek':21B 'permiss':35B 'power':30B 'precondit':23B 'privileg':48B 'routin':32B 'run':43B 'system':47B","search_c":"'bypass':65C 'check':70C 'could':73C 'cpm':52C,58C 'ctrl':55C 'due':66C 'escal':77C 'execut':82C 'exploit':91C 'failur':71C 'interact':86C 'lead':74C 'local':76C 'mbox':53C 'mbox.c':59C 'need':84C,89C 'permiss':64C 'possibl':63C 'power':54C 'precondit':69C 'privileg':79C,83C 'sswrp':56C 'system':81C 'user':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58680","severity":null,"published_at":"2026-11-10T20:19:23+00:00","modified_at":"2026-11-10T20:19:23+00:00","first_seen_at":"2026-11-10T20:46:09+00:00","fetched_at":"2026-11-10T20:46:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}