{"id":"ASB-A-503384798", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58844", "A-503384798"], "details":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff", "https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd", "https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb", "https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82", "https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365", "https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7", "https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567", "https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56", "https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["41624038543191610686885017007715375996", "248448133933240034659426978387974227154", "95006380817314928719703164325014026971", "171480352673842863366806898539344004762"], "threshold":0.9}, "id":"ASB-A-503384798-08b1ff46", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c"}}, {"deprecated":false, "digest":{"line_hashes":["289407063611588716092795887437893093874", "120881777396063425660938941345686227759", "318534339006631353720719199512862538096", "88563514058459432313143081984217649523", "267048110911112320066824692090450019876", "333089573524713329751715521002527023343", "267600766014704963590229103123679750047", "102942658452205320459231595243138076176", "130123098219720402290164341179997685773", "285146826246643651645637673645456950414", "46305755005106783563398111844690392076", "130767929167497759501197333072556469036", "88797785495928496814009752704485980718"], "threshold":0.9}, "id":"ASB-A-503384798-30fe0215", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff", "target":{"file":"arch/arm64/kvm/hyp/nvhe/mem_protect.c"}}, {"deprecated":false, "digest":{"function_hash":"99892171902826701721908594755211016053", "length":671}, "id":"ASB-A-503384798-4611065e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb", "target":{"file":"virt/kvm/vfio.c", "function":"kvm_vfio_pviommu_attach"}}, {"deprecated":false, "digest":{"line_hashes":["78200546156012581065005364508826195945", "219870121190120044095832161766145461143", "87878553870752821017494372189761903754", "260139003182918249110250837991220553498"], "threshold":0.9}, "id":"ASB-A-503384798-55d19712", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7", "target":{"file":"drivers/iommu/io-pgtable-arm-common.c"}}, {"deprecated":false, "digest":{"line_hashes":["172858350513333507742657896581359888258", "19188731497931507811905194166847152219", "200512177609271170458893180350538234402", "257693533441079552998299631611923969167"], "threshold":0.9}, "id":"ASB-A-503384798-6304250b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365", "target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"}}, {"deprecated":false, "digest":{"function_hash":"248340521753024282317018259587090029697", "length":626}, "id":"ASB-A-503384798-6c78f7fe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567", "target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c", "function":"smmu_unmap_pages"}}, {"deprecated":false, "digest":{"line_hashes":["77932403112495172743288900516447989814", "141526517654518460604088811293200832323", "27836268315525444471369181122377179500", "33757979601207912645308252154973417339", "305458979290355936414707965711092392559", "314650931647502009322239686021033032681", "228057565913214674416804129910504748593", "27899858423427688711248582660830382998", "265205290138312779401596656267812905893", "330542579927671329995984923348170246750", "56678954344851737991566539409408747853", "132441708529659720524479451344967449566", "7410984180084189500776710001672207785", "217674688684235168094731582971025265764", "120648066300451268904949716206175355406"], "threshold":0.9}, "id":"ASB-A-503384798-7dfb2441", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb", "target":{"file":"virt/kvm/vfio.c"}}, {"deprecated":false, "digest":{"function_hash":"30271056533247701012480513573157567652", "length":313}, "id":"ASB-A-503384798-bd0851d4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff", "target":{"file":"arch/arm64/kvm/hyp/nvhe/mem_protect.c", "function":"pkvm_get_guest_pa_request_use_dma"}}, {"deprecated":false, "digest":{"function_hash":"28630826806237706854215928518917763750", "length":1305}, "id":"ASB-A-503384798-c874d33e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/pviommu.c", "function":"pkvm_guest_iommu_alloc_domain"}}, {"deprecated":false, "digest":{"line_hashes":["312151499649679416172919737814952427724", "115084615417835253783636202140222502766", "15439228708167646917245979125535053688", "164974473202816779119343906780207464751"], "threshold":0.9}, "id":"ASB-A-503384798-c93d142a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567", "target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"}}, {"deprecated":false, "digest":{"function_hash":"108573041568332991974728759011982292467", "length":869}, "id":"ASB-A-503384798-e487909d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365", "target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c", "function":"smmu_dev_block_dma"}}, {"deprecated":false, "digest":{"line_hashes":["153902164498098477774347671850454311837", "130354674949910116571797226869444880015", "262433106233822064994947291014900449231", "18196928434785430041265198030326886049", "13449135886361055312864855742305759806", "308141173840057774255914880875883082389", "115954434235475886189381559704039689670", "97714284197860316147735733309126534810", "281411067893976755487892058062093210853", "103341913151600274526709329640577882190", "304421930593443692186783927095526415904", "145824037814593113393870381907519002695", "131082119074990756059685885100848517148", "229112886155432902913955019944505581505", "293763927205804417616403267787362746451", "142523198879685566265018066416225820329", "72408750259996755400318938942019443498", "239110601348960614840379043531224623087", "280707571214749308521727741466878684825", "216035222493827218070035414683755418433", "233322659429533336090153811370252282318", "184977574100344899204029659504273568527", "166722930461464790092532998173163206802"], "threshold":0.9}, "id":"ASB-A-503384798-e660fb8a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/pviommu.c"}}, {"deprecated":false, "digest":{"function_hash":"68851789192442681393706024052447704706", "length":1034}, "id":"ASB-A-503384798-ea165146", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7", "target":{"file":"drivers/iommu/io-pgtable-arm-common.c", "function":"arm_lpae_split_blk_unmap"}}, {"deprecated":false, "digest":{"function_hash":"332917304898042235801722513513513737901", "length":513}, "id":"ASB-A-503384798-f495574c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c", "function":"kvm_iommu_free_domain"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd"}]}