{"id":"ASB-A-508703395", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-16T15:47:14.630094689Z", "aliases":["CVE-2026-58848", "A-508703395"], "details":"In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-09-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa"], "severity":"Critical", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"310385443741218351177156884496385857431", "length":310}, "id":"ASB-A-508703395-1947e804", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c", "function":"hyp_alloc_init"}}, {"deprecated":false, "digest":{"function_hash":"12357050324315498628568085862543581195", "length":1203}, "id":"ASB-A-508703395-457e54bd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c", "function":"hyp_alloc_reclaim"}}, {"deprecated":false, "digest":{"function_hash":"184766305271300472968909488530058511782", "length":492}, "id":"ASB-A-508703395-648f13db", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c", "function":"hyp_allocator_unmap"}}, {"deprecated":false, "digest":{"function_hash":"318147132209463899106439040966706539236", "length":156}, "id":"ASB-A-508703395-a52aca3d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c", "function":"hyp_alloc_refill"}}, {"deprecated":false, "digest":{"function_hash":"275946637994782592449289997320887638320", "length":963}, "id":"ASB-A-508703395-a94bc892", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c", "function":"hyp_allocator_map"}}, {"deprecated":false, "digest":{"function_hash":"193868351171522295897668148236525916179", "length":400}, "id":"ASB-A-508703395-c104a790", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c", "function":"hyp_alloc_reclaimable"}}, {"deprecated":false, "digest":{"line_hashes":["102105221974474339529575402669257080735", "28810332218086102059130202334618870112", "277403341497140947356563269172893487259", "239332585223470089111344449081477676667", "262187667874114497141257644113508162191", "312645257081326403482045354863928032020", "172130783597591093465630422484655535953", "113713664442039110506112065879747248979", "240496708600390877187019682478339334395", "65480500886000432613098713376694333168", "271997671097251301302868597296073664637", "74656739048361120972463636947079981449", "300438934493177005546216912414276904170", "258700893197633341138695516855112258413", "142605292849206751083462563520479639997", "310669571672466373789787369715713246428", "217049205472986142126487666920938534764", "116270618149779742376810783429594776752", "215183027768689860106506847127291536811", "1076375568717781068831495006572932668", "190813681747740021776666725260016314778", "197384890781688317101039428982121029042", "139374217422073337029319082174951949003", "306267325338045793264487890383627301477", "219196937553821000353839716200711400360", "264271588185144662575844092746833101759", "37063042003684854299939009083539794720", "132731967741206424737401800538014741381", "229165711540620041275785296955362039794", "262717638833981395981539819958260828303", "312220980116762925149491989622855634900", "58415822925940462814009326765540943731", "26465629976013453978732467809955203552", "186483445812055514508623862953520413482", "114794598164648280719526733712530882589", "292564451154519140161061391730010243873", "101554538750168042370220915884264870647", "291474919858104529204048594468563427076", "49193051790340261040853306593941214822", "272289507928242745716964614533980051242", "116519780704302541559271550010074493549", "96903984288496861367481468199630921144", "189781180503942676188390555801276845842", "281341161773589885569124758478091866253", "174346541223258075251958334355782389470", "234794896211178499777398427062672188508", "134801675321699817482509524654923721646", "84797215757686131559264605825630402304", "3698692250165883069976467721987992557", "265122978429717267504543526066865518485", "101554538750168042370220915884264870647", "191118317353612546891730588711847590752", "289862362272342448542544033806319058743", "142578369245759828585966955799690352466", "252838139395207581371139674052741371351", "192296108490662996894568013627650114560", "124322086956474187300723346090602610071", "42330167070667655326155048315240353470", "161034420724018464999264332477504063695", "218197142879610450204741759089348233924", "161219960435967604154855341075090423686", "209123634644615243534000270785680712912", "198831467073625580073644778134767600180"], "threshold":0.9}, "id":"ASB-A-508703395-d81fb9a7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa", "target":{"file":"arch/arm64/kvm/hyp/nvhe/alloc.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/8f68185b8289dbe43e96f3d2b036c81c83cc58aa"}]}