CVE-2026-58695

A missing bounds check (CWE-120) in gmc_phy_lp3_exit_restore_registers of phy_power.c — code that restores PHY registers when the device exits the LP3 low-power state — allows a buffer overflow that leads to local escalation of privilege. It is triggered by code running locally on the device, with no user interaction required; the advisory states System execution privileges are needed for exploitation. A successful attacker gains elevated (kernel-context) execution on the device, with high impact on confidentiality, integrity and availability (CVSS 3.1 score 7.8, AV:L/PR:L). The CVE was assigned by Google's device-security CNA ([email protected]), indicating Google mobile device platforms, but the advisory does not name specific device models or a fixed version. No public proof-of-concept is known and the issue is not listed in CISA KEV, so exploitation has not been confirmed.

What to do: Apply the Google/Android (Pixel) security update that includes this fix once published — the advisory provides no fixed build number, so check the device's Android security patch level after updating. Until patched, reduce risk by avoiding installation of untrusted apps that can run local code on affected devices. No public exploit or KEV listing exists, so there are no specific indicators of compromise to hunt for; monitor Google's Android/Pixel security bulletins for the fixed release.