{"id":"ASB-A-512433296","details":"In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-512433296","CVE-2026-59048"],"modified":"2026-11-02T16:56:19.104843992Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"Pixel-family specific:0"},{"fixed":"Pixel-family specific:2026-11-05"}]}],"versions":["Pixel-family specific"],"ecosystem_specific":{"spl":"2026-11-05","types":["ID"],"vanir_signatures":[{"target":{"file":"arch/arm64/kvm/hyp/nvhe/trace.c","function":"rb_cpu_init"},"deprecated":false,"digest":{"length":1410,"function_hash":"125923464344421602565120170126384420608"},"id":"ASB-A-512433296-12a0aa8a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea"},{"target":{"function":"rb_cpu_teardown","file":"arch/arm64/kvm/hyp/nvhe/trace.c"},"deprecated":false,"digest":{"function_hash":"164211295244707333535547612943068864148","length":513},"id":"ASB-A-512433296-22956549","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea"},{"target":{"file":"arch/arm64/kvm/hyp/nvhe/trace.c","function":"rb_page_init"},"deprecated":false,"digest":{"length":313,"function_hash":"165690527243896420205736874780043099204"},"id":"ASB-A-512433296-3a3b7603","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e"},{"source":"https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea","target":{"file":"arch/arm64/kvm/hyp/nvhe/trace.c","function":"rb_page_init"},"deprecated":false,"digest":{"function_hash":"165690527243896420205736874780043099204","length":313},"id":"ASB-A-512433296-55010afe","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-512433296-85d32d4a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e","target":{"file":"arch/arm64/kvm/hyp/nvhe/trace.c","function":"rb_cpu_init"},"deprecated":false,"digest":{"function_hash":"134284167832286179940387655260717883224","length":1378}},{"deprecated":false,"digest":{"function_hash":"324801724758313207953703409265286638784","length":457},"id":"ASB-A-512433296-c4807039","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e","target":{"function":"rb_cpu_teardown","file":"arch/arm64/kvm/hyp/nvhe/trace.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e","target":{"file":"arch/arm64/kvm/hyp/nvhe/trace.c"},"deprecated":false,"digest":{"line_hashes":["80901285252655712015729057153851175311","148838059631772505562748788520177863519","168154443880311713266466766198048622051","27950049148863764658648366180638647230","126218323297906714732583045798279170993","75783164179166226617785947639598713696","290894498041123396645234201201557066628","236013735039640572129717617879272486081","169347771034316835258966653437465928385","36802898168102489703193491154884169509","301471447288080467094228942227740175509","100527848312306610240007059299134393950","157445384212681889023483526515019957560","138580121783969771288042490509933369637","262046636596778315471866779429666211849","249689425222519935644910302935285622613","63372823659322879145742347436326806222","197055713445890505565258379122311667634","118830858296386741581118050923026291831","279877772660460228340847190663642533822","279220167104145569958287420070039994641","287480077517568461066121108773343522124","110161614846118292561080412723014324396","23098273034092358018394617138142280994","157347275417301881586348538247534539304","187880007233982717558674850971698439746","215422375208943329890308774881251228688","260820443130488483046155815424002569968","202937840289506388306592737261254913809","252940672823682505387616641925227536895","25446769622683256502145371925388389268","86366977944114211114766673266732825666","93487425269031085725630410266626176061","212464941491434682634082506191650509342","135275075646698328619411935442298751472","127941125775627373912014423842676174156","90036281011227741099726899487388142759","192968696805637101086742808430674371559","59082480443582984041904310100451666931","41243481366513643057736215296898527391","53755723563919562336736161724569469740","212425504382601644063964591270525600694","187651790100369794289686656945936431106","304967166921060125345111817103450322090","58095820128366861038111287109409636837","199032201471079610019243463750347756012","78892865660310059856150283714489801128","192881341853562076042480675094953194455","45833461341434530420431202020734638571","108559674118872906176795613321066949821","163305946613821581578903447100640674800","261409511535293447926485442598603962387","142883399042963454866427690434812677687","76113751703310198089481102246953339794","113469156519620184140139239267219598008","22503784265180588220964015531030200140","87239688873406792392805927502756988262","79770031511769521611119784737689814838","338026959987159319105669620735123271895"],"threshold":0.9},"id":"ASB-A-512433296-d0f1bf85"},{"id":"ASB-A-512433296-e042e741","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea","target":{"file":"arch/arm64/kvm/hyp/nvhe/trace.c"},"deprecated":false,"digest":{"line_hashes":["80901285252655712015729057153851175311","148838059631772505562748788520177863519","168154443880311713266466766198048622051","27950049148863764658648366180638647230","126218323297906714732583045798279170993","75783164179166226617785947639598713696","290894498041123396645234201201557066628","236013735039640572129717617879272486081","167382525713010953681414953200985747060","85143868464791913586932799254127028931","301471447288080467094228942227740175509","100527848312306610240007059299134393950","157445384212681889023483526515019957560","138580121783969771288042490509933369637","262046636596778315471866779429666211849","249689425222519935644910302935285622613","63372823659322879145742347436326806222","197055713445890505565258379122311667634","118830858296386741581118050923026291831","279877772660460228340847190663642533822","279220167104145569958287420070039994641","287480077517568461066121108773343522124","253541962699366690293044592154880321208","46357190700073003687131560494058148068","157347275417301881586348538247534539304","187880007233982717558674850971698439746","139572184192676791682840051630129002506","28381921352332619240279668492075808596","320731338145548458362196410610112192927","268130792267722761574352784800198763715","25446769622683256502145371925388389268","86366977944114211114766673266732825666","93487425269031085725630410266626176061","212464941491434682634082506191650509342","135275075646698328619411935442298751472","127941125775627373912014423842676174156","310467823476719460190855203461735607777","196631417248261428059138113733118447770","168928923155942398372178705529369974239","249614503945507199105518839323878861113","53755723563919562336736161724569469740","212425504382601644063964591270525600694","187651790100369794289686656945936431106","304967166921060125345111817103450322090","58095820128366861038111287109409636837","199032201471079610019243463750347756012","78892865660310059856150283714489801128","192881341853562076042480675094953194455","45833461341434530420431202020734638571","108559674118872906176795613321066949821","163305946613821581578903447100640674800","261409511535293447926485442598603962387","142883399042963454866427690434812677687","76113751703310198089481102246953339794","113469156519620184140139239267219598008","293457743566701981277290399873729693617","213665807480715866802772140945904499903","332245570910860185358183430181454157884","191415205083119672092427108647455688893"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e","https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-512433296.json"}}],"schema_version":"1.9.2"}