{"id":"ASB-A-512428751","details":"In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-512428751","CVE-2026-59045"],"modified":"2026-11-02T16:56:11.996063183Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/eb970aae88c0f45056f4501b7815a9b5c7ab0435"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f89e83e20aa69fbdd5b2f2de284dafcaadbda7c7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/e10fb80c80387aa1f26695b57df95afe0ef00481"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"Critical","spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"pkvm_reset_vcpu"},"deprecated":false,"digest":{"length":1041,"function_hash":"170734051339526332790469851534190216764"},"id":"ASB-A-512428751-079c6281","signature_type":"Function"},{"source":"https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","target":{"function":"handle___kvm_vcpu_run","file":"arch/arm64/kvm/hyp/nvhe/hyp-main.c"},"deprecated":false,"digest":{"length":615,"function_hash":"110086353484787813843171617475561066046"},"id":"ASB-A-512428751-087cef3c","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"teardown_hyp_vcpu_init"},"deprecated":false,"digest":{"length":296,"function_hash":"126973487161746262406057170574409819066"},"id":"ASB-A-512428751-09ba31fc"},{"deprecated":false,"digest":{"function_hash":"252019808607611719003286049255187454361","length":366},"id":"ASB-A-512428751-0ae85a5e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"pvm_psci_vcpu_off"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","target":{"file":"arch/arm64/kvm/hyp/include/nvhe/pkvm.h"},"deprecated":false,"digest":{"line_hashes":["49844807563815293560039034051739776589","311041034476221550309883812845137157723","19852775824779640755947365831089669321","87145535067508583497253979990319818841"],"threshold":0.9},"id":"ASB-A-512428751-0c3898e3","signature_type":"Line"},{"source":"https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","target":{"file":"arch/arm64/kvm/hyp/nvhe/hyp-main.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["328966851738176558431802199462962285057","199773323427186310626344710316328626305","137552377769036518556630547360809869665","173139480657421877206820240348930809820","239569829809832275881462688640883574015","225258106061095471275078443322193865552","259617591611395622867506362831620963520"]},"id":"ASB-A-512428751-17ea684e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf","target":{"file":"arch/arm64/kvm/hyp/nvhe/hyp-main.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["161662974162394857686066894365224471683","181256384645679426933291055169273123112","259958714394768353677443765198264022336","5534475891710709177776140246926775787","173359157800489582741103694212908951630"]},"id":"ASB-A-512428751-1d30c78a"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","target":{"function":"pkvm_reset_vcpu","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"function_hash":"225815452481224860826434616328158004123","length":1062},"id":"ASB-A-512428751-2d3c1b11","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","target":{"file":"arch/arm64/kvm/hyp/include/nvhe/pkvm.h"},"deprecated":false,"digest":{"line_hashes":["60553359767945396257940399908796773822","123138851162227800164000686341276264699","262397916188689856627989116308992882870","154246755336058396237546224878186110109","98724044022708246602149978598310386267","37615547606747672846537133825876132488","150632186046188934745083445991919557904"],"threshold":0.9},"id":"ASB-A-512428751-52c7be2b","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"line_hashes":["292935989480129851326166763271150862006","22369530153580831366684165479206045586","249818744269171166769512810632399724557","162081632017171274052119520776288218415","135247283466428291212090070355115458704","168519713212687391679721947074939768212","184930415797566683705696744719517284313","175964628024150014624280622047594524634","172711798152934092642689017494795896659","165104304772392099774500697643016170372","274566689434068013783644840911454987754","174050785087374323288150648706296300097","292404605983324830151713781681750383649","72654100266100844651600329341079341359","223400683584527686398832468986090354088","322448997826482752357486204093640616255","214306361816496204969415440125688666445","226548573341596097661581175659890576822","46082266488785220966894927374666393011","21975282137246114319231413097563764656","88679057626414555511486974737997939952","187761956574903422118860380000396836942","14430234165131456791159829294376610474","241763759291414921810762878086376866737"],"threshold":0.9},"id":"ASB-A-512428751-67158d90"},{"deprecated":false,"digest":{"function_hash":"338312771625605469484831000756960656148","length":802},"id":"ASB-A-512428751-7b824a1b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204","target":{"function":"pkvm_vcpu_init_psci","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"}},{"target":{"file":"arch/arm64/kvm/hyp/nvhe/hyp-main.c"},"deprecated":false,"digest":{"line_hashes":["161662974162394857686066894365224471683","181256384645679426933291055169273123112","259958714394768353677443765198264022336","5534475891710709177776140246926775787","173359157800489582741103694212908951630"],"threshold":0.9},"id":"ASB-A-512428751-90dcefb0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"init_pkvm_hyp_vcpu"},"deprecated":false,"digest":{"length":1507,"function_hash":"49126462288672467086621418734124234277"},"id":"ASB-A-512428751-962ef9ec","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"pvm_psci_vcpu_off"},"deprecated":false,"digest":{"length":366,"function_hash":"252019808607611719003286049255187454361"},"id":"ASB-A-512428751-971d44ee","signature_type":"Function"},{"id":"ASB-A-512428751-a6c7dd86","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b","target":{"file":"arch/arm64/kvm/hyp/nvhe/hyp-main.c","function":"handle_pvm_entry_psci"},"deprecated":false,"digest":{"function_hash":"9315909322613027344953773622163983349","length":662}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","target":{"function":"pkvm_vcpu_init_psci","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"function_hash":"225028972253553668565223159569669847951","length":825},"id":"ASB-A-512428751-ab23077d","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"line_hashes":["23557239505860527005044840421566958529","233801835399018581060931665383804956304","119236251576245815911532409016809008483","129109501556142187263259537622155192378","324330601168118258098058307204393852752","246421830361000142006943404760583254011","274724057995125098339255606621752988532","309066441694656323936829022070501124787","227968354639988636124289709314769753529","187628773313163475628499314556141710086","102430873781958654472129868180837729380","282082038715205785522934584353630003124","259801411415041907005105269458448463871","184855159924599194869412137370771885805","52160697395942408359714701844732007022","304488713438258377186898442481932800327","169919783565460611269273186007405918210","48668995260131523923467784607103998964","20989894035300483109758876957531238535"],"threshold":0.9},"id":"ASB-A-512428751-b485abaa"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","target":{"function":"pkvm_reset_vcpu","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"function_hash":"96237299177062478601610979463650519902","length":968},"id":"ASB-A-512428751-ba5e75b2"},{"source":"https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"pkvm_reset_vcpu"},"deprecated":false,"digest":{"length":1114,"function_hash":"211857369892966174167686053301445164363"},"id":"ASB-A-512428751-c0fad308","signature_type":"Function","signature_version":"v1"},{"target":{"function":"init_pkvm_hyp_vcpu","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"length":1053,"function_hash":"59671602339359592687494386884381227793"},"id":"ASB-A-512428751-d148a3dc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3"},{"source":"https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"pkvm_vcpu_init_psci"},"deprecated":false,"digest":{"length":730,"function_hash":"34345654969666544881411908440373523085"},"id":"ASB-A-512428751-d98116e2","signature_type":"Function","signature_version":"v1"},{"digest":{"length":662,"function_hash":"9315909322613027344953773622163983349"},"id":"ASB-A-512428751-dbc9f386","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf","target":{"file":"arch/arm64/kvm/hyp/nvhe/hyp-main.c","function":"handle_pvm_entry_psci"},"deprecated":false},{"id":"ASB-A-512428751-dfa8fe3d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c","function":"pkvm_vcpu_init_psci"},"deprecated":false,"digest":{"function_hash":"338312771625605469484831000756960656148","length":802}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["259288045765329507516279571816973888712","280076362788690054544221313601532296072","299697395760762192742948661245880108557","51108080872024818961065857474748521239","125302928215886298010291014704008284947","293625554867276520060376813402912544254","306340084639029466669198724259247558397","33766364190626403215775904497119242344","328594298098129024689560272672390725674","299560735751846259541862979857236038474","234410884279188824703095054878107885289","15699153583083538599798223883311672774","145031270476869158193681139745075973539","222370429002225604038236099656981294378","122332870192580713863201981251351389254","156523996723684271624832196181443239894","249641929396180396625269034981493662435","312519084444398069109973556439044153398","272708593472623729548963623452058014211","149591604464841047557118337745457063053","32308358863148181257094497373640886640","221511992901056418769136148248500557154","292178717719113089282458415273471870159","272118596130067290139396595927308212367","193770276454358611509728623459051751540","64290408495930635880257188972186584987","153193861880444742243866061706931487954"]},"id":"ASB-A-512428751-e77a4d12"},{"deprecated":false,"digest":{"function_hash":"129656306715448906406395434984765983813","length":1135},"id":"ASB-A-512428751-efe7f208","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204","target":{"function":"pkvm_reset_vcpu","file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"}},{"target":{"file":"arch/arm64/kvm/hyp/include/nvhe/pkvm.h"},"deprecated":false,"digest":{"line_hashes":["308130599782545066433293853133603036983","311041034476221550309883812845137157723","19852775824779640755947365831089669321","87145535067508583497253979990319818841"],"threshold":0.9},"id":"ASB-A-512428751-f5825f7d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","target":{"file":"arch/arm64/kvm/hyp/nvhe/pkvm.c"},"deprecated":false,"digest":{"line_hashes":["198740063659857666956411656146944128814","294795901014128522465015227446696609323","299697395760762192742948661245880108557","51108080872024818961065857474748521239","3559251355060348435249719894956474485","333279743099652001338781737872505094873","274362377902648703167286874793828233496","33766364190626403215775904497119242344","328594298098129024689560272672390725674","299560735751846259541862979857236038474","178054681686638433810427887466213431887","13059028335841947352607168654145163167","326149464616917498646862857514324459091","144884501930716293935677514998855849186","41302147935528934618131437091169546914","159897066122565250729912316706691895807","249641929396180396625269034981493662435","312519084444398069109973556439044153398","272708593472623729548963623452058014211","100234387712201236378601714614441282020","32308358863148181257094497373640886640","221511992901056418769136148248500557154","292178717719113089282458415273471870159","272118596130067290139396595927308212367","193770276454358611509728623459051751540","64290408495930635880257188972186584987","153193861880444742243866061706931487954"],"threshold":0.9},"id":"ASB-A-512428751-f5f35907"}],"fixes":["https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","https://android.googlesource.com/kernel/common/+/eb970aae88c0f45056f4501b7815a9b5c7ab0435","https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b","https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204","https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6","https://android.googlesource.com/kernel/common/+/f89e83e20aa69fbdd5b2f2de284dafcaadbda7c7","https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf","https://android.googlesource.com/kernel/common/+/e10fb80c80387aa1f26695b57df95afe0ef00481","https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-512428751.json"}}],"schema_version":"1.9.2"}