{"id":"ASB-A-503427706","details":"In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503427706","CVE-2026-59042"],"modified":"2026-11-02T16:56:24.931202009Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"target":{"file":"arch/arm64/kvm/mmu.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["231520258661084437035069121034076758151","61301290856518534950014653865964009010","17591186730993521825819332428975139745","267923338169421308795064577729276814186","202408692573087794594771166319195634280","131896970497448970707292580566649756022","258968619884888012167589603309344926266","311763470847692280480877621343198801192","92781354478828882164808800843444571401","141679975530323996472164379431684205790","270797308262305581927870801497646185323","327490922470472527898479389232574790896"]},"id":"ASB-A-503427706-2f2195b7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"},{"target":{"file":"arch/arm64/kvm/mmu.c"},"deprecated":false,"digest":{"line_hashes":["884964870999501708403952319862192588","281332276852774800029357972914858291970","303840220048358610062685186341438316780","224637922435959787995502791283960628383","250478376323875636785735544990249181770","132877581860792188070608573927551072987","327603620699174586107241792011921219947"],"threshold":0.9},"id":"ASB-A-503427706-4778f2c7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e","target":{"function":"__pkvm_pages_to_ppages","file":"arch/arm64/kvm/mmu.c"},"deprecated":false,"digest":{"function_hash":"121137098619445386874861688423547636428","length":1692},"id":"ASB-A-503427706-b3136d37","signature_type":"Function"},{"deprecated":false,"digest":{"length":2049,"function_hash":"272203396194671723193700564700363316228"},"id":"ASB-A-503427706-dd8d7130","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715","target":{"function":"pkvm_mem_abort","file":"arch/arm64/kvm/mmu.c"}}],"fixes":["https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715","https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503427706.json"}}],"schema_version":"1.9.2"}