---
id: "CVE-2026-58847"
kind: "vulnerability"
aliases: ["CVE-2026-58847"]
title: "Android kernel: double free in KVM VFIO pviommu attach error path allows local privilege escalation"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Android kernel", "fixed": ["security patch level 2026-11-05"], "affected": "Android kernel builds with KVM VFIO pviommu code, before security patch level 2026-11-05", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "infrastructure", "kvm", "linux-kernel", "local-privilege-escalation", "pkvm", "self-hosted", "vfio"]
not_affected_if: ["kvm-not-in-use"]
published_at: "2026-11-02T20:17:48+00:00"
first_seen_at: "2026-11-02T20:35:31+00:00"
updated_at: "2026-11-02T20:42:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58847", "first_seen_at": "2026-11-02T20:35:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T20:42:01+00:00"}]
---

# Android kernel: double free in KVM VFIO pviommu attach error path allows local privilege escalation

Google's Android Security Bulletin for November 2026 lists CVE-2026-58847 as a high-severity elevation-of-privilege bug in the Android kernel. In kvm_vfio_pviommu_attach() (virt/kvm/vfio.c), when the function fails after the file has been created, the pviommu struct is freed. The release function then frees it a second time when the file is put. A local app or user needs no extra privileges and no user interaction. The fix is an Android common-kernel commit. The bulletin does not report exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Android kernel affected Android kernel builds with KVM VFIO pviommu code, before security patch level 2026-11-05 fixed security patch level 2026-11-05

## How to check

Android devices: Settings > About phone > Android version > Android security patch level. A level of 2026-11-05 or later includes the fix. Kernel builders: check whether your Android common kernel tree contains commit 8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb (ANDROID: KVM: vfio: Avoid double free in error path), or whether virt/kvm/vfio.c still frees the pviommu struct on the error path of kvm_vfio_pviommu_attach() after the file is created.

## Fix

Install the Android security patch level 2026-11-05 or later. For kernel trees, apply Android common kernel commit 8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb (Bug A-503385812).

## Timeline

- 2026-11-02T20:35:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58847
- 2026-11-02T20:42:01+00:00 analyst — Source: Android Security Bulletin Nov 2026 (Kernel components, EoP, High, A-503385812, patch level 2026-11-05) and AOSP commit 8c62fa09 'Avoid double free in error path'. Android-specific, not upstream Linux, so retitled; no kernel.org stable advisory exists. Affected kernel versions not listed. No exploitation or PoC found. Skipped X search; CVE is a day old.

## Documents

- [advisory] Android Security Bulletin—November 2026 https://source.android.com/docs/security/bulletin/2026/2026-11-01
- [fix] ANDROID: KVM: vfio: Avoid double free in error path https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb

## From the sources

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_