Google Android: Local privilege escalation via use-after-free in kernel

Summary

Multiple locations in the Android kernel contain a use-after-free vulnerability caused by a race condition. A local attacker with System execution privileges can use it to escalate privileges and affect confidentiality, integrity and availability. No user interaction is needed, but the attacker must already have a foothold on the device, so this is a privilege-escalation step rather than an entry point. Google rates it Moderate; the CVSS 6.4 score is unverified and the affected component (kernel or Bluetooth) is not confirmed.

Affected

• Android kernel according to the CVE record; Pixel devices per the Pixel Update Bulletin (component listed as Bluetooth, unconfirmed)
• Exact affected builds: Unknown.

Fixed in

• Security patch level 2026-11-05 or later (Pixel Update Bulletin November 2026, advisory A-522373070)

Workaround

Unknown. No mitigation published by Google; apply the patch.

Exploitation

• No evidence of in-the-wild exploitation found.
• Strix lists KEV as No.
• No public proof of concept found.

Our recommendation

• Install security patch level 2026-11-05 or later on all company Pixel devices.
• Use MDM to enforce the patch level and verify that it is reported correctly.
• Limit local and physical access to managed devices.
• Include the update in the regular monthly patch cycle; priority normal.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-58778 www.cve.org
• Pixel Update Bulletin November 2026 source.android.com
• OSV PUB-A-522373070 osv.dev
• Strix CVE-2026-58778 (secondary) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:18.