CVE-2026-58728

CVE-2026-58728 is a race condition (CWE-362) in the ARM64_TLBI TLB-invalidation code in the kernel's mmu.h, resulting in possible memory corruption on ARM64 systems. A local attacker who already has limited code execution on the device (for example, via a malicious app) can trigger the race window to corrupt kernel memory and escalate privileges to the kernel context, gaining full read/write/impact on confidentiality, integrity, and availability, with no user interaction required. Because it is a race condition, exploitation has high attack complexity (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L/UI:N), meaning an attacker must repeatedly attempt to hit the timing window, which tempers but does not eliminate the risk. It was assigned by Google's Android vulnerability management team, indicating the impacted product is the Android platform's ARM64 Linux kernel, with fixes distributed through the monthly Android Security Bulletin and OEM/carrier updates. No public proof of concept exists, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation is currently known.

What to do: Apply the monthly Android Security Bulletin patch containing this fix as soon as it ships, and verify the device's security patch level in Settings (System > About phone > Android security update), since kernel fixes reach devices only via OEM/carrier OTA updates. Because exploitation requires a foothold on the device, restrict sideloading and installation of apps from untrusted sources, and use mobile threat detection to flag apps attempting unusual kernel-adjacent operations. For fleets, check OEM support status — devices past end-of-life may never receive the fix and should be prioritized for retirement.