{"id":"ASB-A-503384798","details":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503384798","CVE-2026-58844"],"modified":"2026-11-02T16:56:22.626643243Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"High","spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["41624038543191610686885017007715375996","248448133933240034659426978387974227154","95006380817314928719703164325014026971","171480352673842863366806898539344004762"]},"id":"ASB-A-503384798-08b1ff46","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd"},{"deprecated":false,"digest":{"line_hashes":["289407063611588716092795887437893093874","120881777396063425660938941345686227759","318534339006631353720719199512862538096","88563514058459432313143081984217649523","267048110911112320066824692090450019876","333089573524713329751715521002527023343","267600766014704963590229103123679750047","102942658452205320459231595243138076176","130123098219720402290164341179997685773","285146826246643651645637673645456950414","46305755005106783563398111844690392076","130767929167497759501197333072556469036","88797785495928496814009752704485980718"],"threshold":0.9},"id":"ASB-A-503384798-30fe0215","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff","target":{"file":"arch/arm64/kvm/hyp/nvhe/mem_protect.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","target":{"file":"virt/kvm/vfio.c","function":"kvm_vfio_pviommu_attach"},"deprecated":false,"digest":{"function_hash":"99892171902826701721908594755211016053","length":671},"id":"ASB-A-503384798-4611065e"},{"digest":{"line_hashes":["78200546156012581065005364508826195945","219870121190120044095832161766145461143","87878553870752821017494372189761903754","260139003182918249110250837991220553498"],"threshold":0.9},"id":"ASB-A-503384798-55d19712","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","target":{"file":"drivers/iommu/io-pgtable-arm-common.c"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365","target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172858350513333507742657896581359888258","19188731497931507811905194166847152219","200512177609271170458893180350538234402","257693533441079552998299631611923969167"]},"id":"ASB-A-503384798-6304250b","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567","target":{"function":"smmu_unmap_pages","file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"},"deprecated":false,"digest":{"function_hash":"248340521753024282317018259587090029697","length":626},"id":"ASB-A-503384798-6c78f7fe","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["77932403112495172743288900516447989814","141526517654518460604088811293200832323","27836268315525444471369181122377179500","33757979601207912645308252154973417339","305458979290355936414707965711092392559","314650931647502009322239686021033032681","228057565913214674416804129910504748593","27899858423427688711248582660830382998","265205290138312779401596656267812905893","330542579927671329995984923348170246750","56678954344851737991566539409408747853","132441708529659720524479451344967449566","7410984180084189500776710001672207785","217674688684235168094731582971025265764","120648066300451268904949716206175355406"],"threshold":0.9},"id":"ASB-A-503384798-7dfb2441","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","target":{"file":"virt/kvm/vfio.c"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff","target":{"file":"arch/arm64/kvm/hyp/nvhe/mem_protect.c","function":"pkvm_get_guest_pa_request_use_dma"},"deprecated":false,"digest":{"function_hash":"30271056533247701012480513573157567652","length":313},"id":"ASB-A-503384798-bd0851d4","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"28630826806237706854215928518917763750","length":1305},"id":"ASB-A-503384798-c874d33e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82","target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/pviommu.c","function":"pkvm_guest_iommu_alloc_domain"}},{"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"},"deprecated":false,"digest":{"line_hashes":["312151499649679416172919737814952427724","115084615417835253783636202140222502766","15439228708167646917245979125535053688","164974473202816779119343906780207464751"],"threshold":0.9},"id":"ASB-A-503384798-c93d142a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567"},{"deprecated":false,"digest":{"function_hash":"108573041568332991974728759011982292467","length":869},"id":"ASB-A-503384798-e487909d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365","target":{"function":"smmu_dev_block_dma","file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"}},{"target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/pviommu.c"},"deprecated":false,"digest":{"line_hashes":["153902164498098477774347671850454311837","130354674949910116571797226869444880015","262433106233822064994947291014900449231","18196928434785430041265198030326886049","13449135886361055312864855742305759806","308141173840057774255914880875883082389","115954434235475886189381559704039689670","97714284197860316147735733309126534810","281411067893976755487892058062093210853","103341913151600274526709329640577882190","304421930593443692186783927095526415904","145824037814593113393870381907519002695","131082119074990756059685885100848517148","229112886155432902913955019944505581505","293763927205804417616403267787362746451","142523198879685566265018066416225820329","72408750259996755400318938942019443498","239110601348960614840379043531224623087","280707571214749308521727741466878684825","216035222493827218070035414683755418433","233322659429533336090153811370252282318","184977574100344899204029659504273568527","166722930461464790092532998173163206802"],"threshold":0.9},"id":"ASB-A-503384798-e660fb8a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82"},{"deprecated":false,"digest":{"function_hash":"68851789192442681393706024052447704706","length":1034},"id":"ASB-A-503384798-ea165146","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","target":{"file":"drivers/iommu/io-pgtable-arm-common.c","function":"arm_lpae_split_blk_unmap"}},{"digest":{"function_hash":"332917304898042235801722513513513737901","length":513},"id":"ASB-A-503384798-f495574c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd","target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c","function":"kvm_iommu_free_domain"},"deprecated":false}],"fixes":["https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff","https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd","https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82","https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365","https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567","https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56","https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503384798.json"}}],"schema_version":"1.9.2"}