CVE-2026-58941

CVE-2026-58941 is an out-of-bounds read/write vulnerability caused by improper input validation (CWE-20) in multiple functions of iommu.c, the IOMMU (I/O memory management) component of the Linux kernel used in Android. A local attacker can trigger the flaw by supplying improperly validated input to IOMMU-related kernel interfaces, with no user interaction and no additional privileges required. Successful exploitation lets the attacker read or write out-of-bounds kernel memory, escalating from local app-level access to kernel-level control of the device. Affected are Android devices running kernels that include the vulnerable iommu.c code prior to the September 2026 Android security update; the provided data does not specify exact version ranges. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.1%, so no exploitation is currently known.

What to do: Apply the September 2026 Android security update (or later) as soon as your device OEM delivers it, and confirm the patch level in Settings under Security & privacy shows September 2026 or newer. Because exploitation requires local code execution, avoid sideloading or installing apps from untrusted sources on unpatched devices. Monitor your OEM's security bulletin for device-specific kernel patches addressing this CVE.