{"id":"ASB-A-508703583", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-15T16:26:34.087665475Z", "aliases":["CVE-2026-58941", "A-508703583"], "details":"In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-09-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767", "https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3"], "severity":"Critical", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"264482395746000152718381422210532535195", "length":899}, "id":"ASB-A-508703583-1c059ca6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c", "function":"kvm_iommu_map_pages"}}, {"deprecated":false, "digest":{"function_hash":"238996105801259486971555701731024422188", "length":860}, "id":"ASB-A-508703583-37599f80", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c", "function":"kvm_iommu_unmap_pages"}}, {"deprecated":false, "digest":{"function_hash":"254604543551036709214478599840308356605", "length":929}, "id":"ASB-A-508703583-5443c031", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c", "function":"kvm_iommu_map_pages"}}, {"deprecated":false, "digest":{"function_hash":"200415428025544392919405363236986920662", "length":604}, "id":"ASB-A-508703583-5f563b92", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c", "function":"kvm_iommu_unmap_pages"}}, {"deprecated":false, "digest":{"function_hash":"234316622788873391411321850509039253621", "length":1119}, "id":"ASB-A-508703583-7ee1ed53", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c", "function":"kvm_iommu_map_sg"}}, {"deprecated":false, "digest":{"line_hashes":["141049021410644715946840514428513432498", "158138277371186674516231275995710545974", "79997249925543081994914027226634192463", "274152412415536797002300237997984525837", "219394081305822530079361396563675666117", "315208734809143390763783845073763519291"], "threshold":0.9}, "id":"ASB-A-508703583-e94fa4a3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c"}}, {"deprecated":false, "digest":{"line_hashes":["141049021410644715946840514428513432498", "158138277371186674516231275995710545974", "79997249925543081994914027226634192463", "274152412415536797002300237997984525837", "219394081305822530079361396563675666117", "315208734809143390763783845073763519291", "65809212997561650670059550104560835388", "120193941240071099530044917387172882994", "315754950284799572999556990794430889209"], "threshold":0.9}, "id":"ASB-A-508703583-ef8e8694", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3", "target":{"file":"arch/arm64/kvm/hyp/nvhe/iommu/iommu.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3"}]}