{"id":"ASB-A-508703395","details":"In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508703395","CVE-2026-58848"],"modified":"2026-09-14T15:55:59.659151492Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-09-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-508703395-1947e804","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa","target":{"function":"hyp_alloc_init","file":"arch/arm64/kvm/hyp/nvhe/alloc.c"},"deprecated":false,"digest":{"function_hash":"310385443741218351177156884496385857431","length":310}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa","target":{"function":"hyp_alloc_reclaim","file":"arch/arm64/kvm/hyp/nvhe/alloc.c"},"deprecated":false,"digest":{"function_hash":"12357050324315498628568085862543581195","length":1203},"id":"ASB-A-508703395-457e54bd"},{"id":"ASB-A-508703395-648f13db","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa","target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c","function":"hyp_allocator_unmap"},"deprecated":false,"digest":{"length":492,"function_hash":"184766305271300472968909488530058511782"}},{"digest":{"length":156,"function_hash":"318147132209463899106439040966706539236"},"id":"ASB-A-508703395-a52aca3d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa","target":{"function":"hyp_alloc_refill","file":"arch/arm64/kvm/hyp/nvhe/alloc.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"275946637994782592449289997320887638320","length":963},"id":"ASB-A-508703395-a94bc892","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa","target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c","function":"hyp_allocator_map"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa","target":{"function":"hyp_alloc_reclaimable","file":"arch/arm64/kvm/hyp/nvhe/alloc.c"},"deprecated":false,"digest":{"length":400,"function_hash":"193868351171522295897668148236525916179"},"id":"ASB-A-508703395-c104a790","signature_type":"Function"},{"target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c"},"deprecated":false,"digest":{"line_hashes":["102105221974474339529575402669257080735","28810332218086102059130202334618870112","277403341497140947356563269172893487259","239332585223470089111344449081477676667","262187667874114497141257644113508162191","312645257081326403482045354863928032020","172130783597591093465630422484655535953","113713664442039110506112065879747248979","240496708600390877187019682478339334395","65480500886000432613098713376694333168","271997671097251301302868597296073664637","74656739048361120972463636947079981449","300438934493177005546216912414276904170","258700893197633341138695516855112258413","142605292849206751083462563520479639997","310669571672466373789787369715713246428","217049205472986142126487666920938534764","116270618149779742376810783429594776752","215183027768689860106506847127291536811","1076375568717781068831495006572932668","190813681747740021776666725260016314778","197384890781688317101039428982121029042","139374217422073337029319082174951949003","306267325338045793264487890383627301477","219196937553821000353839716200711400360","264271588185144662575844092746833101759","37063042003684854299939009083539794720","132731967741206424737401800538014741381","229165711540620041275785296955362039794","262717638833981395981539819958260828303","312220980116762925149491989622855634900","58415822925940462814009326765540943731","26465629976013453978732467809955203552","186483445812055514508623862953520413482","114794598164648280719526733712530882589","292564451154519140161061391730010243873","101554538750168042370220915884264870647","291474919858104529204048594468563427076","49193051790340261040853306593941214822","272289507928242745716964614533980051242","116519780704302541559271550010074493549","96903984288496861367481468199630921144","189781180503942676188390555801276845842","281341161773589885569124758478091866253","174346541223258075251958334355782389470","234794896211178499777398427062672188508","134801675321699817482509524654923721646","84797215757686131559264605825630402304","3698692250165883069976467721987992557","265122978429717267504543526066865518485","101554538750168042370220915884264870647","191118317353612546891730588711847590752","289862362272342448542544033806319058743","142578369245759828585966955799690352466","252838139395207581371139674052741371351","192296108490662996894568013627650114560","124322086956474187300723346090602610071","42330167070667655326155048315240353470","161034420724018464999264332477504063695","218197142879610450204741759089348233924","161219960435967604154855341075090423686","209123634644615243534000270785680712912","198831467073625580073644778134767600180"],"threshold":0.9},"id":"ASB-A-508703395-d81fb9a7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa"}],"fixes":["https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa"],"severity":"Critical","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508703395.json"}}],"schema_version":"1.9.0"}