CVE-2026-59046

Published: Nov 2, 2026Modified: Nov 5, 2026

6.2

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.5 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected (1)

Products: Google: Android

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Android	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://android.googlesource.com/kernel/common/+/4a75aa4e840f294efd47084e083a6e91069bce58

Source: security@android.com

Patch

https://android.googlesource.com/kernel/common/+/525cfccadb92e7c9314d03cce600fed7335874d9

Source: security@android.com

Patch

https://source.android.com/docs/security/bulletin/2026/2026-11-01

Source: security@android.com

PatchVendor Advisory

Timeline

No history available yet.