Android Kernel CVE-2026-58846

Exploitation requires a local user-space process running with at least low privileges on an Android device that has the KVM IOMMU subsystem active - specifically devices using the Android Virtualization Framework or pKVM (protected KVM), which is present on Android 13+ devices with hardware virtualization support. The attacker must be able to invoke KVM IOMMU scatter-gather mapping operations (kvm_iommu_map_sg), which implies either a KVM-capable context or an app that can interact with the relevant kernel interface. No user interaction is required after the attacker's process is running. Devices without KVM/virtualization support in their kernel build are not affected by this specific code path. ADB-restricted or locked-down MDM-enrolled devices reduce the attack surface to apps already installed and running on-device.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) is well-calibrated for this class of vulnerability: local, low-complexity, low-privilege kernel UAF leading to full system compromise. SSVC rates Technical Impact as total, consistent with C:H/I:H/A:H, and Exploitation as none, with Automatable: no, indicating no current weaponization or mass-exploitation scenario. EPSS data is not present in the input, but UAF kernel privilege escalation bugs historically attract post-patch exploit development once the fix is public and the diff reveals the vulnerable code path. The 'Denial Of Service' tag is accurate alongside 'Privilege Escalation' because a failed exploitation attempt typically results in a kernel panic. Even a mid-sized municipal IT team in kalisz managing an Android device fleet should treat this as a priority patch given the zero-interaction-required, low-privilege exploit path. There is no KEV listing and no public POC at time of analysis, which reduces urgency slightly but does not diminish the critical impact potential.

An attacker with a low-privileged shell on an Android device (e.g., via a malicious app that gained code execution or via ADB access) crafts a sequence of KVM IOMMU scatter-gather mapping operations that triggers the missing permission check, causing a use-after-free in kernel memory. By manipulating the freed memory region before it is reclaimed, the attacker corrupts kernel data structures to redirect execution flow and escalate to root. No user interaction is required, and no public POC has been identified at time of analysis.