CVE-2026-58734

A race condition (CWE-362) in the google_mba_recv_msg function of google_mba_poll.c — part of the battery-management (Google Modular Battery Architecture) driver in Google Pixel device kernels — can result in an out-of-bounds write (CWE-787). A malicious app or process already present on the device with only low privileges can exploit the race to corrupt kernel memory and escalate to kernel-level privileges, with no user interaction and no additional execution privileges required. Although the attack vector is local and attack complexity is high (CVSS 3.1: 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), successful exploitation would give the attacker full read/write/availability impact over the device. The advisory data does not specify which Pixel/Android kernel builds are affected, so defenders should treat any device shipping this driver as potentially exposed. There is no known public PoC and no indication of in-the-wild exploitation; the flaw is not on the CISA KEV list.

What to do: Deploy the Google Pixel security update containing the fix for CVE-2026-58734 as soon as it appears in the Pixel/Android Security Bulletin, and verify device patch levels across your fleet. Because exploitation requires local code execution with low privileges, restrict sideloading and untrusted app installation on managed Android devices to limit the preconditions. Monitor Google's bulletin for the exact affected kernel/build versions once disclosed and prioritize devices that ship the google_mba driver.