EUVD-2026-115443
GHSA-w59q-69c8-fqpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExecute unprivileged code on device
-
DeliveryConcurrently invoke pKVM page operations
-
ExploitWin race in __pkvm_pages_to_ppages
-
ExecutionTrigger out-of-bounds write
-
ImpactCorrupt hypervisor memory and escalate privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already execute local code on the affected device (AV:L), and applies only to devices running Android's protected KVM (pKVM) hypervisor, which is present on newer ARM64 hardware rather than all Android devices. The attacker must win a race condition (CWE-362) in __pkvm_pages_to_ppages to trigger the out-of-bounds write, reflected in AC:H - the timing window materially limits reliability. No elevated privileges (PR:N) and no user interaction (UI:N) are needed beyond running code locally. Limiting factors: local access prerequisite, dependence on pKVM being active on the device, and the difficulty of winning the race on each attempt. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.4 High) describes a local, high-complexity flaw requiring no privileges and no user interaction, with total impact (C:H/I:H/A:H) on the hypervisor it corrupts - consistent with SSVC Technical Impact: total. Critically, the signals point AWAY from urgency: SSVC Exploitation is 'none' and Automatable is 'no', EPSS is only 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit was identified. The AC:H metric reflects the race-condition nature (CWE-362) - an attacker must win a timing window, which is hard to automate and reduces reliability. The vendor priority label is 'this_week', not act_now/emergency. Note the tension between PR:N (no privileges) and the local race-condition mechanism: realistic exploitation still requires the attacker to already be running local code on the device (e.g., a malicious or compromised app), so 'no privileges' means no elevated privileges, not remote reach. Bottom line: a real local privilege-escalation bug worth patching on the normal Android monthly cycle, not a drop-everything emergency. |
| Exploit ScenarioDerived | A malicious or compromised unprivileged app running on an affected Android device repeatedly invokes the pKVM page-management path (__pkvm_pages_to_ppages in mmu.c) while racing a concurrent operation to trigger the out-of-bounds write. Winning the race corrupts hypervisor-managed memory, letting the attacker escalate privileges on the local device. No public exploit was identified at time of analysis, and the high attack complexity (race window) makes reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Local privilege escalation in Android's protected KVM (pKVM) hypervisor, where a race condition in __pkvm_pages_to_ppages (mmu.c) can produce an out-of-bounds write and yield high confidentiality, integrity and availability impact at the hypervisor level. Only devices running pKVM - the protected KVM hypervisor present on newer ARM64 Android hardware - are exposed, and the attacker must already execute local code and win a timing-dependent race, which is captured by AC:H and materially limits reliability. No public exploit code has been identified at time of analysis, EPSS is low at 0.16% (5th percentile) and SSVC records no exploitation, making this a genuine but second-tier priority; the vendor fixes are referenced in AOSP kernel commits and the November 2026 Android Security Bulletin.
RemediationAI
Apply the Android security update published in the November 2026 bulletin (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which is the authoritative source for the patched builds and kernel branches carrying the fixed pKVM code; the corresponding upstream changes are AOSP common kernel commits 1569a00286640e452ce917ee8b3cec04c5cc3715 and 382cffbd3842b64260993d2438926a9f2a0a447e, available at https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715 and https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e. A specific patched build or kernel version number is not listed in the available data, so patch status is 'upstream fix available (commit); released patched version not independently confirmed' and administrators should verify against the bulletin and their OEM's build notes before assuming a device is covered. Because exploitation requires prior local code execution and an active pKVM hypervisor, the practical exposure is concentrated on newer ARM64 devices; no separate configuration-level workaround is identified in the available sources, and the vendor fix (or an OEM build containing it) is the only complete resolution - residual risk until then is that an attacker who already runs local code on a pKVM-enabled device may attempt the race repeatedly.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pKVM (protected KVM) is Android's ARM64 hypervisor that isolates the host kernel from guest virtual machines, so memory-management code in its stage-2/page-table path runs with privileges above the Linux kernel itself. The flaw is an out-of-bounds write in the __pkvm_pages_to_ppages routine in mmu.c, classified as CWE-362 (concurrent execution using shared resource with improper synchronization); the root cause class is a race condition in hypervisor page-table handling, and the exact interleaving that widens the window is not described in the available sources. Because the bug sits in the hypervisor rather than the guest kernel, successful exploitation would cross the isolation boundary pKVM is designed to enforce, but the trigger is timing dependent (AC:H) and reachable only where pKVM is active, which per the assessment means newer ARM64 hardware rather than the entire Android install base. Affected CPE data identifies google:android (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) with EUVD listing the Android kernel as the affected component.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app can trigger it with no elevated privileges (AV:L/PR:N), but must win a race window (AC:H); corrupting the pKVM hypervisor yields total impact (C/I/A:H).
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2026-59042 is a high-severity local privilege escalation flaw in Android's protected KVM hypervisor (pKVM) that could allow an attacker with local code execution to break out of the hypervisor and gain elevated privileges on affected ARM64 Android devices. While only newer hardware and specific conditions are exposed, a successful exploit could compromise the confidentiality, integrity, and availability of the entire device, making it a significant risk for organizations with fleets of such devices. Leadership should prioritize patching when available and monitor for exploitation, though no active attacks have been observed.
No vendor-released patch identified at time of analysis; interim mitigations include restricting local code execution through strict app vetting, enforcing least privilege on device applications, and monitoring for anomalous hypervisor activity until an update is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB