CVE-2026-58701

A race condition in trusty_dputc() in generic-arm64-smcall.c of Google's Trusty trusted execution environment (TEE) allows an out-of-bounds write when concurrent calls to the debug character-output SMC path corrupt a shared buffer. Exploitation is local and requires the attacker to already hold System execution privileges, with no user interaction needed. A successful attack could escalate privileges and corrupt memory in the TEE/secure-monitor context, potentially impacting confidentiality, integrity, and availability (CVSS 7.0, high). Devices that ship the Trusty TEE — most notably Google Pixel phones and other AOSP-based Android builds — are in scope, though the advisory does not specify fixed versions. No public proof of concept exists and the flaw is not in CISA's KEV catalog, so no exploitation is known in the wild.

What to do: Apply the Android/Pixel security bulletin update containing the fix for this CVE as soon as it ships and verify the device security patch level. Because exploitation requires pre-existing System execution privileges, the practical risk is chaining from an already-compromised privileged component — audit for suspicious system processes invoking the Trusty SMC interface and enforce least-privilege on system services. Monitor Google's Android Security Bulletin for the component-specific fix version, since none was listed in the initial data.