{"id":"ASB-A-503427706", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-59042", "A-503427706"], "details":"In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715", "https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["231520258661084437035069121034076758151", "61301290856518534950014653865964009010", "17591186730993521825819332428975139745", "267923338169421308795064577729276814186", "202408692573087794594771166319195634280", "131896970497448970707292580566649756022", "258968619884888012167589603309344926266", "311763470847692280480877621343198801192", "92781354478828882164808800843444571401", "141679975530323996472164379431684205790", "270797308262305581927870801497646185323", "327490922470472527898479389232574790896"], "threshold":0.9}, "id":"ASB-A-503427706-2f2195b7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e", "target":{"file":"arch/arm64/kvm/mmu.c"}}, {"deprecated":false, "digest":{"line_hashes":["884964870999501708403952319862192588", "281332276852774800029357972914858291970", "303840220048358610062685186341438316780", "224637922435959787995502791283960628383", "250478376323875636785735544990249181770", "132877581860792188070608573927551072987", "327603620699174586107241792011921219947"], "threshold":0.9}, "id":"ASB-A-503427706-4778f2c7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715", "target":{"file":"arch/arm64/kvm/mmu.c"}}, {"deprecated":false, "digest":{"function_hash":"121137098619445386874861688423547636428", "length":1692}, "id":"ASB-A-503427706-b3136d37", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e", "target":{"file":"arch/arm64/kvm/mmu.c", "function":"__pkvm_pages_to_ppages"}}, {"deprecated":false, "digest":{"function_hash":"272203396194671723193700564700363316228", "length":2049}, "id":"ASB-A-503427706-dd8d7130", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715", "target":{"file":"arch/arm64/kvm/mmu.c", "function":"pkvm_mem_abort"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"}]}