{"id":"ASB-A-508702141","details":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508702141","CVE-2026-59044"],"modified":"2026-11-02T16:56:21.234485342Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5"],"severity":"Critical","spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"81254865089399762781766763892053610059","length":399},"id":"ASB-A-508702141-0472e2fe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"__pkvm_start_teardown_vm"},"deprecated":false},{"target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["266070129564720093764580315294731733760","42184193747483532599088635137893934220","81017997177472112560676412062056370501","38087160660220118720913299495565273385","101623583210055504047574285678201847388","230933254375419309708908902598878503228","184532742190206378567291316160172379477","49320613657826460553588453061616772881","48377283112590026902419871774578483829","262327366713844548748291770384610077821","7280054027196015049953612995336682544","288862352629270145689344071876203612770","223060689072485746828383332153090602344","294237633181496875554861515265850891046","316670701255868883829852911323557903533","79507446999903499850224504775056754420","324344632895892353101765586392035632619","297252537085933648539449257980456458310","293047567724985950786238084352130625315"]},"id":"ASB-A-508702141-3da0b790","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5"},{"target":{"function":"__pkvm_finalize_teardown_vm","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"function_hash":"270710784214742701292984139871479659989","length":1415},"id":"ASB-A-508702141-492542b9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5"},{"target":{"file":"arch/arm64/kvm/hyp/include/nvhe/pkvm.h"},"deprecated":false,"digest":{"line_hashes":["259432726752519156212926839802390832315","169037309083090689845262157964905002090","86971385136166677498006049656921805507","326497997766043550287117058581982122040","88376860492509038193438046321502818588","174331328233651677432106538606853432087","258575460002559133453148848063353714417"],"threshold":0.9},"id":"ASB-A-508702141-741fb656","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5"},{"digest":{"length":445,"function_hash":"43477530148561989109393951343969818539"},"id":"ASB-A-508702141-e3d278a7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5","target":{"function":"__pkvm_reclaim_dying_guest_page","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508702141.json"}}],"schema_version":"1.9.2"}