{"id":"CVE-2026-59609","kind":"vulnerability","aliases":["CVE-2026-59609"],"related":[],"title":"Android kernel: fence reuse use-after-free lets local apps gain kernel privileges","description":"In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A use-after-free in the kernel's fence manager (fence_manager.c, fence_manager_extract_iif) lets a local process corrupt kernel memory by reusing a fence identifier. An attacker who can run code on the device can escalate to higher privileges, with no user interaction needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","linux-kernel"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","triaged_at":"2026-11-10T20:49:43+00:00","updated_at":"2026-11-10T20:49:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:49:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android kernel: fence reuse use-after-free lets local apps gain kernel privileges","impact":"high","summary":"A use-after-free in the kernel's fence manager (fence_manager.c, fence_manager_extract_iif) lets a local process corrupt kernel memory by reusing a fence identifier. An attacker who can run code on the device can escalate to higher privileges, with no user interaction needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","linux-kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"local code gains kernel-level privileges and takes over the device","analyst_note":"Confirm which kernel or Android versions carry the fence_manager.c fix and whether a patch is published, using the NVD entry and the vendor bulletin.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The description names only the kernel's fence manager code as the flaw and says exploitation needs no extra execution privileges and no user interaction. The sources do not name affected product versions or device families, so whether a given device is exposed is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4541,"output_tokens":467,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-59609':17A,20A 'addit':111C 'android':1A,21B 'app':11A 'attack':56B 'code':60B 'corrupt':47B,88C 'could':102C 'cve':15A,18A 'devic':63B 'due':95C 'escal':65B,106C 'execut':112C 'exploit':121C 'extract':41B,77C 'fenc':3A,35B,37B,39B,53B,75C,80C,92C 'free':8A,30B,100C 'gain':12A 'higher':67B 'identifi':54B,93C 'iif':42B,78C 'infrastructur':22B 'interact':72B,116C 'kernel':2A,13A,25B,33B,48B,89C 'lead':103C 'let':9A,43B 'linux':24B 'linux-kernel':23B 'local':10A,45B,105C 'manag':36B,40B,76C 'manager.c':38B,81C 'memori':49B,90C 'need':73B,114C,119C 'possibl':85C 'privileg':14A,68B,108C,113C 'process':46B 'reus':4A,51B,94C 'run':59B 'use':6A,28B,98C 'use-after-fre':5A,27B 'user':71B,115C 'via':91C 'way':86C","nicknames":[],"mitigations":[],"who_affected":"The description names only the kernel's fence manager code as the flaw and says exploitation needs no extra execution privileges and no user interaction. The sources do not name affected product versions or device families, so whether a given device is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","linuxkernel","unknown"],"campaign_type":null,"search_a":"'-2026':16A,19A '-59609':17A,20A 'android':1A 'app':11A 'cve':15A,18A 'fenc':3A 'free':8A 'gain':12A 'kernel':2A,13A 'let':9A 'local':10A 'privileg':14A 'reus':4A 'use':6A 'use-after-fre':5A","search_b":"'android':21B 'attack':56B 'code':60B 'corrupt':47B 'devic':63B 'escal':65B 'extract':41B 'fenc':35B,37B,39B,53B 'free':30B 'higher':67B 'identifi':54B 'iif':42B 'infrastructur':22B 'interact':72B 'kernel':25B,33B,48B 'let':43B 'linux':24B 'linux-kernel':23B 'local':45B 'manag':36B,40B 'manager.c':38B 'memori':49B 'need':73B 'privileg':68B 'process':46B 'reus':51B 'run':59B 'use':28B 'use-after-fre':27B 'user':71B","search_c":"'addit':111C 'corrupt':88C 'could':102C 'due':95C 'escal':106C 'execut':112C 'exploit':121C 'extract':77C 'fenc':75C,80C,92C 'free':100C 'identifi':93C 'iif':78C 'interact':116C 'kernel':89C 'lead':103C 'local':105C 'manag':76C 'manager.c':81C 'memori':90C 'need':114C,119C 'possibl':85C 'privileg':108C,113C 'reus':94C 'use':98C 'user':115C 'via':91C 'way':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59609","severity":null,"published_at":"2026-11-10T20:19:31+00:00","modified_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","fetched_at":"2026-11-10T20:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}