Live › vulnerability › CVE-2026-58847
Google's Android Security Bulletin for November 2026 lists CVE-2026-58847 as a high-severity elevation-of-privilege bug in the Android kernel. In kvm_vfio_pviommu_attach() (virt/kvm/vfio.c), when the function fails after the file has been created, the pviommu struct is freed. The release function then frees it a second time when the file is put. A local app or user needs no extra privileges and no user interaction. The fix is an Android common-kernel commit. The bulletin does not report exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android devices whose kernel includes the Android-specific KVM VFIO pviommu code, which Google's bulletin lists as 'Affected Android kernel', and which are not yet at security patch level 2026-11-05. Affected versions are not itemised in the bulletin. This is an Android common-kernel change (ANDROID: tag), and no source says that upstream mainline Linux or other distributions' kernels carry the flaw. Devices already at patch level 2026-11-05 or later can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Android kernel | vendor | Android kernel builds with KVM VFIO pviommu code, before security patch level 2026-11-05 | security patch level 2026-11-05 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58847")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.