{"id":"CVE-2026-59046","kind":"vulnerability","aliases":["CVE-2026-59046"],"related":[],"title":"Linux pKVM: out-of-bounds write in guest memory relinquish path","description":"In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in the pKVM hypervisor memory protection code (__pkvm_guest_relinquish_to_host in mem_protect.c) allows an out-of-bounds write caused by improper input validation. Per the description, it can cause a local denial of service with no extra privileges and no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","kernel","linux","pkvm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:57+00:00","first_seen_at":"2026-11-02T20:35:37+00:00","triaged_at":"2026-11-02T20:36:46+00:00","updated_at":"2026-11-02T20:36:46+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T20:36:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux pKVM: out-of-bounds write in guest memory relinquish path","impact":"low","summary":"A flaw in the pKVM hypervisor memory protection code (__pkvm_guest_relinquish_to_host in mem_protect.c) allows an out-of-bounds write caused by improper input validation. Per the description, it can cause a local denial of service with no extra privileges and no user interaction.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","pkvm","android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local denial of service on the host","analyst_note":"Find affected kernel versions and the upstream fix commit for __pkvm_guest_relinquish_to_host from the NVD entry or kernel.org CVE record.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Affects systems running the Android/Linux pKVM hypervisor with the vulnerable mem_protect.c code, which is local-only per the description. The sources do not list affected versions or configurations, so unknown whether a given kernel is included.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":4110,"output_tokens":473,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59046':15A,18A 'addit':105C 'allow':41B 'android':19B 'bound':6A,46B,88C 'caus':48B,58B 'code':32B 'could':96C 'cve':13A,16A 'denial':61B,100C 'descript':55B 'due':90C 'execut':106C 'exploit':115C 'extra':66B 'flaw':25B 'guest':9A,34B,74C 'host':37B,77C 'hypervisor':29B 'improp':50B,92C 'infrastructur':20B 'input':51B,93C 'interact':71B,110C 'kernel':21B 'lead':97C 'linux':1A,22B 'local':60B,99C 'mem':39B,79C 'memori':10A,30B 'need':108C,113C 'out-of-bound':3A,43B,85C 'path':12A 'per':53B 'pkvm':2A,23B,28B,33B,73C 'possibl':84C 'privileg':67B,107C 'protect':31B 'protect.c':40B,80C 'relinquish':11A,35B,75C 'servic':63B,102C 'user':70B,109C 'valid':52B,94C 'write':7A,47B,89C","nicknames":[],"mitigations":[],"who_affected":"Affects systems running the Android/Linux pKVM hypervisor with the vulnerable mem_protect.c code, which is local-only per the description. The sources do not list affected versions or configurations, so unknown whether a given kernel is included.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","kernel","linux","pkvm","unknown"],"first_public_at":"2026-11-02T20:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59046","severity":null,"published_at":"2026-11-02T20:17:57+00:00","modified_at":"2026-11-02T20:17:57+00:00","first_seen_at":"2026-11-02T20:35:37+00:00","fetched_at":"2026-11-02T20:35:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}