EUVD-2026-115584
GHSA-gf46-g52c-3fh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged code execution (malicious app or shell)
-
ExploitInvoke ksys_unshare via unshare() syscall
-
ExecutionTrigger use-after-free memory corruption in fork.c
-
ImpactEscalate to kernel/root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, unprivileged code execution on the device - for example a malicious installed application or an interactive local shell - and to reach the ksys_unshare code path in fork.c, i.e. by issuing the unshare() system call, which is callable without special privileges (PR:N) and without user interaction (UI:N). The primary limiting factor is the local attack vector (AV:L): the bug is NOT remotely reachable, so an attacker cannot exploit it over a network and must first gain code execution on the target by other means. The precise object-lifetime condition that triggers the use-after-free is not described in the available sources. |
| Impact | All available signals point to a serious but locally-scoped kernel flaw rather than a remote-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4 High) describes a use-after-free (CWE-416) reachable with low complexity and no privileges, but only from a LOCAL vector - the attacker must already be able to run code on the device. The SSVC decision framework reinforces this reading: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-scripted), Technical Impact=total (full kernel compromise if triggered). This is consistent with the 'this_week' priority label rather than act_now/emergency. The flaw is NOT in CISA KEV, so it is not confirmed actively exploited. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The references are the four upstream Android common-kernel fix commits plus the November 2026 Android Security Bulletin - these are patches, not exploit code, so no public exploit is indicated. Net: a genuinely high-severity local privilege-escalation bug in an extremely widely-deployed product (Android), worth prompt patching, but the local-only vector and SSVC signals (no exploitation, not automatable) argue against treating it as an in-the-wild emergency. Missing EPSS is the main data gap for precise prioritization. |
| Exploit ScenarioDerived | A malicious or compromised app (or a local shell user) with the ability to run unprivileged code invokes the unshare() system call to drive the vulnerable ksys_unshare path in fork.c, triggering the use-after-free and corrupting kernel memory to escalate from an unprivileged context to kernel/root privileges. No user interaction and no prior privileges are required (AV:L/AC:L/PR:N/UI:N). No public exploit is identified in the provided data; the exact trigger mechanism of the use-after-free is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in the Android kernel lets code that is already running on the device - a malicious installed app or a local shell - trigger a use-after-free in ksys_unshare() and corrupt kernel memory, potentially gaining elevated privileges. The flaw is reachable through the unshare() system call, which is callable without special privileges (CVSS PR:N) and needs no user interaction (UI:N), but it is strictly local (AV:L): the attacker must first obtain unprivileged code execution on the target by some other route, and the precise object-lifetime condition that fires the bug is not described in the available sources. No public exploit has been identified at time of analysis (SSVC exploitation: none) and no CISA KEV listing applies; the assigned priority is this_week, and the impact is rated total by SSVC (C:H/I:H/A:H, base 8.4).
RemediationAI
Apply the Android Security Bulletin 2026-11-01 update for the affected device; that bulletin is the vendor remediation record for this CVE and the four AOSP common-kernel commits (13beada2dac38c2d7303f1700aa16fb5053b919d, efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4, f7d26609785ce56170645d56f306db38e8ba277a, 009c5006c969826d37a2c5fc2721a7bb20d72555) contain the underlying fixes, but no tagged release version or specific build number is stated in the available data, so devices should be validated against the 2026-11-01 security patch level rather than a kernel version string. Because the attack requires pre-existing local code execution and unshare() is callable without privileges, the practical interim control is to constrain how unprivileged local code gets onto the device in the first place - restrict sideloading and untrusted app sources and limit local shell access - while recognising that this reduces exposure rather than removing the kernel flaw, and that no official workaround is documented in the supplied sources.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Linux kernel core task/namespace code, specifically ksys_unshare() in kernel/fork.c, which implements the unshare(2) system call. unshare() detaches parts of the calling process's execution context from its peers - mount, UTS, IPC, PID, network, user and cgroup namespaces as well as the file descriptor table and System V semaphore undo list - by allocating new private copies and repointing the task's references. Because this path manipulates shared, reference-counted objects that other tasks may still hold, it is a classic setting for CWE-416 (Use After Free) defects: a freed object remains reachable and is subsequently dereferenced, giving an attacker a memory-corruption primitive inside the kernel from an unprivileged system call. CPE data attributes the flaw to Google Android (cpe:2.3:a:google:android), and ENISA EUVD describes the affected component as the Android kernel, meaning the vulnerability ships in the kernel builds distributed with Android devices rather than in an application-layer component. The trigger conditions - which specific object and which interleaving of unshare() with another operation frees it prematurely - are not described in the supplied sources, so the mechanism should be treated as uncharacterised beyond the use-after-free class itself.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
unshare() is callable by an unprivileged local process (AV:L, PR:N, UI:N) and the use-after-free yields full kernel compromise, so C/I/A are all High.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 2
Executive ViewAI
A high-severity local privilege escalation vulnerability in the Android kernel (CVE-2026-58826) allows a malicious app or local shell to gain elevated privileges. Successful exploitation could give attackers near-total control of affected devices, enabling data theft, surveillance, or further compromise. Leadership should prioritize remediation because Android devices are ubiquitous in the organization and this flaw requires only local access, which is often the first step in a broader attack chain.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce device posture checks to block outdated Android devices from corporate email and VPN; deploy mobile threat defense (MTD) to detect and block malicious apps exhibiting privilege escalation behavior; restrict sideloading of applications via MDM policy; segment networks to limit lateral movement from compromised devices; and monitor for anomalous privilege escalation events on Android endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB