ASB-A-503427706

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-503427706.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-503427706
Aliases
  • A-503427706
  • CVE-2026-59042
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:24Z
Summary
[none]
Details

In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715",
        "https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"
    ],
    "severity":  "High",
    "spl":  "2026-11-05",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "231520258661084437035069121034076758151",
                    "61301290856518534950014653865964009010",
                    "17591186730993521825819332428975139745",
                    "267923338169421308795064577729276814186",
                    "202408692573087794594771166319195634280",
                    "131896970497448970707292580566649756022",
                    "258968619884888012167589603309344926266",
                    "311763470847692280480877621343198801192",
                    "92781354478828882164808800843444571401",
                    "141679975530323996472164379431684205790",
                    "270797308262305581927870801497646185323",
                    "327490922470472527898479389232574790896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503427706-2f2195b7",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e",
            "target":  {
                "file":  "arch/arm64/kvm/mmu.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "884964870999501708403952319862192588",
                    "281332276852774800029357972914858291970",
                    "303840220048358610062685186341438316780",
                    "224637922435959787995502791283960628383",
                    "250478376323875636785735544990249181770",
                    "132877581860792188070608573927551072987",
                    "327603620699174586107241792011921219947"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503427706-4778f2c7",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715",
            "target":  {
                "file":  "arch/arm64/kvm/mmu.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "121137098619445386874861688423547636428",
                "length":  1692
            },
            "id":  "ASB-A-503427706-b3136d37",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e",
            "target":  {
                "file":  "arch/arm64/kvm/mmu.c",
                "function":  "__pkvm_pages_to_ppages"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "272203396194671723193700564700363316228",
                "length":  2049
            },
            "id":  "ASB-A-503427706-dd8d7130",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715",
            "target":  {
                "file":  "arch/arm64/kvm/mmu.c",
                "function":  "pkvm_mem_abort"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503427706.json"