{"id":"ASB-A-498369302","details":"In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-498369302","CVE-2026-58845"],"modified":"2026-11-02T17:11:16.922518402Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","target":{"file":"mm/pgsize_migration.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["138618085237932976683537176392929429325","164700779995532424601475696421409856549","252739025540847578067275555685806687151","215454440232429209766420161919886400579","23943790151979495776895661211521840440","22726359376400105223267484317924945279","91274249687759423413354398520727346540","281571339791781064631346072896019236316","299273987025652073853273903656277174042","107429096351079446526376777339698333882","200826141141923805549235298799387315448","272068209072605044293301809956686769325","141424315696456174516921644885930780112","226922109799378794449077237734533286066"]},"id":"ASB-A-498369302-060d08ad","signature_type":"Line"},{"id":"ASB-A-498369302-233b672d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","target":{"function":"vma_pad_pages","file":"mm/pgsize_migration.c"},"deprecated":false,"digest":{"function_hash":"167811500446371853359355584031907583456","length":139}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","target":{"file":"mm/pgsize_migration.c","function":"madvise_vma_pad_pages"},"deprecated":false,"digest":{"length":528,"function_hash":"53759836439725674207719238702216148090"},"id":"ASB-A-498369302-33c9f38a","signature_type":"Function"},{"id":"ASB-A-498369302-39a3c640","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","target":{"file":"mm/vma.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["33156412857836771572310817264037046799","163339827389704785468244232014221440244","14555380638292545549596680980096222518","32449271349094710935135881177095038863"]}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","target":{"file":"include/linux/pgsize_migration.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["120039717482386777023365200047912662335","222790380629037764461076007614834868441","21168759412116000934060150640278794887","294847872275791271920786387702043640207","37538056754085589551234921261707506463","199827894468267114451132362989834965672"]},"id":"ASB-A-498369302-4d566150"},{"source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","target":{"file":"mm/pgsize_migration.c","function":"linker_ctx"},"deprecated":false,"digest":{"function_hash":"311320297995644818983312130273865573781","length":727},"id":"ASB-A-498369302-80f69915","signature_type":"Function","signature_version":"v1"},{"target":{"file":"mm/vma.c","function":"copy_vma"},"deprecated":false,"digest":{"length":1476,"function_hash":"182985416136728618113477119094021786260"},"id":"ASB-A-498369302-834b0032","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4"},{"source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"file":"mm/pgsize_migration.c"},"deprecated":false,"digest":{"line_hashes":["138618085237932976683537176392929429325","164700779995532424601475696421409856549","252739025540847578067275555685806687151","215454440232429209766420161919886400579","23943790151979495776895661211521840440","22726359376400105223267484317924945279","91274249687759423413354398520727346540","281571339791781064631346072896019236316","299273987025652073853273903656277174042","107429096351079446526376777339698333882","200826141141923805549235298799387315448","272068209072605044293301809956686769325","141424315696456174516921644885930780112","226922109799378794449077237734533286066"],"threshold":0.9},"id":"ASB-A-498369302-a1f0de4e","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["33156412857836771572310817264037046799","142929018069307820107996373522924193414","271838305760057325923601629056475085049","182168212015796945739125417427987961954"]},"id":"ASB-A-498369302-aa502b16","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"file":"mm/mmap.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"file":"mm/pgsize_migration.c","function":"linker_ctx"},"deprecated":false,"digest":{"length":733,"function_hash":"328020094268287710011788153673150084776"},"id":"ASB-A-498369302-c0ca459e"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"file":"mm/pgsize_migration.c","function":"vma_pad_pages"},"deprecated":false,"digest":{"function_hash":"167811500446371853359355584031907583456","length":139},"id":"ASB-A-498369302-ccca061d","signature_type":"Function"},{"digest":{"function_hash":"33224860657722801318663158644835031303","length":480},"id":"ASB-A-498369302-dc480c60","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"function":"madvise_vma_pad_pages","file":"mm/pgsize_migration.c"},"deprecated":false},{"id":"ASB-A-498369302-e5ef4d12","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"file":"include/linux/pgsize_migration.h"},"deprecated":false,"digest":{"line_hashes":["12152606423924547036832362234982228355","294847872275791271920786387702043640207","37538056754085589551234921261707506463","199827894468267114451132362989834965672"],"threshold":0.9}},{"digest":{"function_hash":"86340606046549809134060597708794628970","length":1527},"id":"ASB-A-498369302-e824f1c9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","target":{"function":"copy_vma","file":"mm/mmap.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4"],"severity":"High","spl":"2026-11-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498369302.json"}}],"schema_version":"1.9.2"}