CVE-2026-58847: Double Free

Q: What level of access does an attacker need to exploit this issue?

Exploitation requires local access, but no additional execution privileges or user interaction are required.

Q: Which products are identified as affected?

The record identifies the Android Linux kernel and Google Android. It does not provide affected version or build ranges.

Published Nov 1, 2026

Updated

In kvmvfiopviommuattach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

2 affected componentsFixes available

android/:linux_kernel:>=:0<:2026-11-05

:2026-11-05

Google Android

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Exploitation requires local access, but no additional execution privileges or user interaction are required.

Which products are identified as affected?

The record identifies the Android Linux kernel and Google Android. It does not provide affected version or build ranges.

CVE-2026-58847: Double Free

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which products are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which products are identified as affected?