AI analysis
CVE-2026-58846 is a use-after-free in the kvm_iommu_map_sg function (iommu.c) of the KVM IOMMU code in the Android Linux kernel, caused by a missing permission check (CWE-269). A local attacker can reach the vulnerable scatter-gather mapping path and trigger the flaw without user interaction and with no additional execution privileges. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Affected parties are users of Android devices running vulnerable kernel builds; Google shipped the fix in the September 2026 Android Security Update. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.
What to do: Apply the September 2026 Android Security Update (or the corresponding OEM/SoC kernel patch) as it reaches your fleet, prioritizing devices where users can install and run untrusted local apps. Confirm with OEMs that the kvm_iommu_map_sg kernel fix is included in their builds, and until patched, restrict app installs from untrusted sources to reduce local-attack surface. No public PoC or in-the-wild exploitation is known, so standard monthly patch cadence is adequate.
Affected
| Google (Android) Android OS (Linux kernel, KVM IOMMU — kvm_iommu_map_sg in iommu.c) | — |
Estimated exposure
masswell over 1,000,000 devices — plausibly billions, given the Android installed base (vulnerable subset unknown) — Android runs on an estimated 3+ billion active devices worldwide and the September 2026 Android Security Update distributes this kernel fix across the ecosystem, though only devices whose kernels include the KVM IOMMU mapping code are…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.