CVE-2026-58824

critical

Description

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/docs/security/bulletin/2026/2026-11-01

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115582

https://android.googlesource.com/kernel/common/+/8be8949794c96f10348fdd3d8dc7740fdfecd4e2

https://android.googlesource.com/kernel/common/+/5a6735b89ba7c8684d36e2ecd9b02e834e97de9c

Details

Source: Mitre, NVD

Published: 2026-11-02

Updated: 2026-11-03

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical