{"id":"CVE-2026-58827","kind":"vulnerability","aliases":["CVE-2026-58827"],"related":[],"title":"Android kernel dma-buf race condition allows use-after-free and local privilege escalation (fixed in 2026-11-05 patch level)","description":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Google's November 2026 Android Security Bulletin lists this as a High-severity elevation-of-privilege bug in the kernel's Direct Memory Access Buffer (dma-buf.c) component: a race condition causing a use-after-free. Exploitation needs no extra privileges and no user interaction, but is local. The bulletin does not say it is exploited.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Android","fixed":["2026-11-05"],"affected":"security patch level before 2026-11-05","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","dma-buf","infrastructure","linux-kernel","linux-servers","mobile"],"not_affected_if":[],"how_to_check":"On an Android device: Settings > About phone > Android version > Android security patch level; 2026-11-05 or later is fixed. Vendors may ship it later than Google. Also check any non-Android Linux kernel you run for the two upstream commits; the bulletin does not say that those kernels are affected.","fix":"Android security patch level 2026-11-05 or later (kernel upstream commits 769fa413e80cca30ff767f6f3e18f920d0353f67 and 6642375b48bea1fc287a9281db591a8edc74db79, per the bulletin; Android bug A-499359964).","status":"open","published_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","triaged_at":"2026-11-02T20:39:08+00:00","updated_at":"2026-11-02T20:41:47+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-02T20:39:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel dma-buf: race condition enables use-after-free and local privilege escalation","impact":"high","summary":"A race condition in the Linux kernel's dma-buf.c shared-buffer code can cause a use-after-free bug. An attacker with local access can use it to gain higher privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","linux-servers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel-level privileges, full machine takeover","analyst_note":"Find affected kernel version ranges and the fixed commit from the NVD entry or the upstream kernel CVE record.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the affected dma-buf code, where local users or processes can run code. The sources do not list affected kernel versions or configurations. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":4078,"output_tokens":406,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected kernel version ranges and the fixed commit from the NVD entry or the upstream kernel CVE record.","search":"'-05':21A '-11':20A '-2026':25A,28A '-58827':26A,29A '2026':19A,46B 'access':68B 'addit':134C 'allow':8A 'android':1A,30A,31B,47B 'buf':5A,34B,72B,110C 'buffer':69B 'bug':61B 'bulletin':49B,97B 'c':73B,111C 'caus':78B 'compon':74B 'condit':7A,77B,123C 'could':125C 'cve':24A,27A 'direct':66B 'dma':4A,33B,71B,109C 'dma-buf':3A,32B,70B,108C 'due':119C 'elev':58B 'elevation-of-privileg':57B 'escal':16A,129C 'execut':135C 'exploit':84B,103B,144C 'extra':87B 'fix':17A 'free':12A,83B,118C 'function':106C 'googl':43B 'high':55B 'high-sever':54B 'infrastructur':35B 'interact':92B,139C 'kernel':2A,38B,64B 'lead':126C 'level':23A 'linux':37B,40B 'linux-kernel':36B 'linux-serv':39B 'list':50B 'local':14A,95B,128C 'memori':67B 'mobil':42B 'multipl':105C 'need':85B,137C,142C 'novemb':45B 'patch':22A 'possibl':115C 'privileg':15A,60B,88B,131C,136C 'race':6A,76B,122C 'say':100B 'secur':48B 'server':41B 'sever':56B 'use':10A,81B,116C 'use-after-fre':9A,80B 'user':91B,138C","nicknames":[],"mitigations":[],"who_affected":"Android devices whose kernel contains the vulnerable dma-buf code and whose security patch level is older than 2026-11-05. An attacker needs to run code locally on the device, such as a malicious app. Devices already at patch level 2026-11-05 or later can skip it. The bulletin does not list affected kernel versions, and it does not say that non-Android Linux servers are affected.","tier":"B","verified":{"fix":{"at":"2026-11-02T20:41:47Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1427}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Android phone to the November 2026 security update (patch level 2026-11-05 or later): Settings > System > Software update.","pkeys":["android"],"ptokens":["android"],"labels":["android","dmabuf","high","infrastructure","linuxkernel","linuxservers","mobile"],"first_public_at":"2026-11-02T20:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58827","severity":null,"published_at":"2026-11-02T20:17:47+00:00","modified_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","fetched_at":"2026-11-02T20:35:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58827:1427","url":null,"severity":null,"published_at":"2026-11-02T20:41:47+00:00","modified_at":"2026-11-02T20:41:47+00:00","first_seen_at":"2026-11-02T20:41:47+00:00","fetched_at":"2026-11-02T20:41:47+00:00","note":"Not a generic Linux CVE: it is in Google's Android Security Bulletin Nov 2026, kernel section, 2026-11-05 patch level, A-499359964, EoP High. Bulletin read via WebFetch summary because web-cli truncated; fix verified from it. No kernel version ranges published. No exploitation noted. Skipped X search."}],"documents":[{"id":53783,"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","title":"Android Security Bulletin—November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":53802,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-58827/","title":"Rapid7: CVE-2026-58827 Google Android dma-buf.c","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}