CVE-2026-58846

CVE-2026-58846 is a use-after-free in the kvm_iommu_map_sg function (iommu.c) of the KVM IOMMU code in the Android Linux kernel, caused by a missing permission check (CWE-269). A local attacker can reach the vulnerable scatter-gather mapping path and trigger the flaw without user interaction and with no additional execution privileges. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Affected parties are users of Android devices running vulnerable kernel builds; Google shipped the fix in the September 2026 Android Security Update. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Apply the September 2026 Android Security Update (or the corresponding OEM/SoC kernel patch) as it reaches your fleet, prioritizing devices where users can install and run untrusted local apps. Confirm with OEMs that the kvm_iommu_map_sg kernel fix is included in their builds, and until patched, restrict app installs from untrusted sources to reduce local-attack surface. No public PoC or in-the-wild exploitation is known, so standard monthly patch cadence is adequate.