Live › vulnerability › CVE-2026-59046
A flaw in the pKVM hypervisor memory protection code (__pkvm_guest_relinquish_to_host in mem_protect.c) allows an out-of-bounds write caused by improper input validation. Per the description, it can cause a local denial of service with no extra privileges and no user interaction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Affects systems running the Android/Linux pKVM hypervisor with the vulnerable mem_protect.c code, which is local-only per the description. The sources do not list affected versions or configurations, so unknown whether a given kernel is included.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-59046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.