ASB-A-508703583

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-508703583.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-508703583
Aliases
  • A-508703583
  • CVE-2026-58941
Published
2026-09-01T00:00:00Z
Modified
2026-10-08T16:55:27Z
Summary
[none]
Details

In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-09-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767",
        "https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3"
    ],
    "severity": "Critical",
    "spl": "2026-09-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "264482395746000152718381422210532535195",
                "length": 899
            },
            "id": "ASB-A-508703583-1c059ca6",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c",
                "function": "kvm_iommu_map_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "238996105801259486971555701731024422188",
                "length": 860
            },
            "id": "ASB-A-508703583-37599f80",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c",
                "function": "kvm_iommu_unmap_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "254604543551036709214478599840308356605",
                "length": 929
            },
            "id": "ASB-A-508703583-5443c031",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c",
                "function": "kvm_iommu_map_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "200415428025544392919405363236986920662",
                "length": 604
            },
            "id": "ASB-A-508703583-5f563b92",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c",
                "function": "kvm_iommu_unmap_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "234316622788873391411321850509039253621",
                "length": 1119
            },
            "id": "ASB-A-508703583-7ee1ed53",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c",
                "function": "kvm_iommu_map_sg"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "141049021410644715946840514428513432498",
                    "158138277371186674516231275995710545974",
                    "79997249925543081994914027226634192463",
                    "274152412415536797002300237997984525837",
                    "219394081305822530079361396563675666117",
                    "315208734809143390763783845073763519291"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508703583-e94fa4a3",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/6bc773e9c9f8ec6c5c431934462badbbb7d21767",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "141049021410644715946840514428513432498",
                    "158138277371186674516231275995710545974",
                    "79997249925543081994914027226634192463",
                    "274152412415536797002300237997984525837",
                    "219394081305822530079361396563675666117",
                    "315208734809143390763783845073763519291",
                    "65809212997561650670059550104560835388",
                    "120193941240071099530044917387172882994",
                    "315754950284799572999556990794430889209"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508703583-ef8e8694",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/ba7833622fc3581c388d0da922aaab529aec43b3",
            "target": {
                "file": "arch/arm64/kvm/hyp/nvhe/iommu/iommu.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508703583.json"