{"id":"CVE-2026-58847","kind":"vulnerability","aliases":["CVE-2026-58847"],"related":[],"title":"Android kernel: double free in KVM VFIO pviommu attach error path allows local privilege escalation","description":"In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Google's Android Security Bulletin for November 2026 lists CVE-2026-58847 as a high-severity elevation-of-privilege bug in the Android kernel. In kvm_vfio_pviommu_attach() (virt/kvm/vfio.c), when the function fails after the file has been created, the pviommu struct is freed. The release function then frees it a second time when the file is put. A local app or user needs no extra privileges and no user interaction. The fix is an Android common-kernel commit. The bulletin does not report exploitation.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Android kernel","fixed":["security patch level 2026-11-05"],"affected":"Android kernel builds with KVM VFIO pviommu code, before security patch level 2026-11-05","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","infrastructure","kvm","linux-kernel","local-privilege-escalation","pkvm","self-hosted","vfio"],"not_affected_if":["kvm-not-in-use"],"how_to_check":"Android devices: Settings > About phone > Android version > Android security patch level. A level of 2026-11-05 or later includes the fix. Kernel builders: check whether your Android common kernel tree contains commit 8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb (ANDROID: KVM: vfio: Avoid double free in error path), or whether virt/kvm/vfio.c still frees the pviommu struct on the error path of kvm_vfio_pviommu_attach() after the file is created.","fix":"Install the Android security patch level 2026-11-05 or later. For kernel trees, apply Android common kernel commit 8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb (Bug A-503385812).","status":"open","published_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","triaged_at":"2026-11-02T20:39:02+00:00","updated_at":"2026-11-02T20:42:01+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-02T20:39:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux KVM: double free in VFIO pviommu attach enables local privilege escalation","impact":"high","summary":"A logic error in the kvm_vfio_pviommu_attach function in vfio.c can cause a double free of memory. A local user can use this to escalate privileges on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kvm","vfio","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel-level privileges on the host","analyst_note":"Find affected and fixed kernel versions and the upstream patch commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-58847) and kernel.org stable advisories.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["kvm-not-in-use"],"who_is_affected":"Systems running a Linux kernel with KVM and VFIO support, where virtual machines use pass-through IOMMU features. The sources do not state the affected kernel versions. Machines without KVM/VFIO in use are likely not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4098,"output_tokens":482,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected and fixed kernel versions and the upstream patch commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-58847) and kernel.org stable advisories.","search":"'-2026':17A,20A,49B '-58847':18A,21A,50B '2026':46B 'addit':159C 'allow':12A 'android':1A,22A,24B,41B,63B,117B 'app':102B 'attach':9A,69B,132C 'bug':60B 'bulletin':43B,123B 'code':148C 'commit':121B 'common':119B 'common-kernel':118B 'could':150C 'creat':80B 'cve':16A,19A,48B 'doubl':3A,139C 'due':141C 'elev':57B 'elevation-of-privileg':56B 'error':10A,145C 'escal':15A,33B,154C 'execut':160C 'exploit':127B,169C 'extra':107B 'fail':74B 'file':77B,97B 'fix':114B 'free':4A,90B,140C 'freed':85B 'function':73B,88B 'googl':39B 'high':54B 'high-sever':53B 'host':37B 'infrastructur':25B 'interact':112B,164C 'kernel':2A,23A,29B,64B,120B 'kvm':6A,26B,66B,129C 'lead':151C 'linux':28B 'linux-kernel':27B 'list':47B 'local':13A,31B,101B,153C 'local-privilege-escal':30B 'logic':144C 'need':105B,162C,167C 'novemb':45B 'path':11A 'pkvm':34B 'possibl':138C 'privileg':14A,32B,59B,108B,156C,161C 'put':99B 'pviommu':8A,68B,82B,131C 'releas':87B 'report':126B 'second':93B 'secur':42B 'self':36B 'self-host':35B 'sever':55B 'struct':83B 'time':94B 'user':104B,111B,163C 'vfio':7A,38B,67B,130C 'vfio.c':134C 'virt/kvm/vfio.c':70B","nicknames":[],"mitigations":[],"who_affected":"Android devices whose kernel includes the Android-specific KVM VFIO pviommu code, which Google's bulletin lists as 'Affected Android kernel', and which are not yet at security patch level 2026-11-05. Affected versions are not itemised in the bulletin. This is an Android common-kernel change (ANDROID: tag), and no source says that upstream mainline Linux or other distributions' kernels carry the flaw. Devices already at patch level 2026-11-05 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T20:42:01Z","by":"analyst","doc":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","run_id":1425},"how_to_check":{"at":"2026-11-02T20:42:01Z","by":"analyst","doc":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","run_id":1425}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Android phone to the November 2026 security update (security patch level 2026-11-05 or later): Settings > System > System update.","pkeys":["androidkernel","kernel"],"ptokens":["android","kernel"],"labels":["android","high","infrastructure","kvm","linuxkernel","localprivilegeescalation","pkvm","selfhosted","vfio"],"first_public_at":"2026-11-02T20:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58847","severity":null,"published_at":"2026-11-02T20:17:48+00:00","modified_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","fetched_at":"2026-11-02T20:35:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58847:1425","url":null,"severity":null,"published_at":"2026-11-02T20:42:01+00:00","modified_at":"2026-11-02T20:42:01+00:00","first_seen_at":"2026-11-02T20:42:01+00:00","fetched_at":"2026-11-02T20:42:01+00:00","note":"Source: Android Security Bulletin Nov 2026 (Kernel components, EoP, High, A-503385812, patch level 2026-11-05) and AOSP commit 8c62fa09 'Avoid double free in error path'. Android-specific, not upstream Linux, so retitled; no kernel.org stable advisory exists. Affected kernel versions not listed. No exploitation or PoC found. Skipped X search; CVE is a day old."}],"documents":[{"id":53783,"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","title":"Android Security Bulletin—November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":53804,"url":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","title":"ANDROID: KVM: vfio: Avoid double free in error path","kind":"release","source":"analyst","publisher":null,"text":"On the error path of kvm_vfio_pviommu_attach() when a file is already created, the release function will be called when it is put on error path, so no need to free the pviommu struct. Bug: 503385812. File: virt/kvm/vfio.c","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}