Android kernel: Out-of-bounds write in pKVM SMMUv3 driver allows privilege escalation
Summary
A missing bounds check in the smmu_domain_config_s1 function of the arm-smmu-v3.c driver allows an out-of-bounds write in the Android kernel. A local attacker with System-level privileges can use it to escalate privileges. No user interaction is required. The CVE record and NVD assessment are still pending, and the CVSS 6.7 score is not yet confirmed by NVD.
Affected
- Android kernel (affected versions not specified in the CVE record; default status is unaffected)
- Component: arm-smmu-v3.c (pKVM SMMUv3), listed in the Pixel Update Bulletin November 2026 under Pixel, Critical
- Unknown: exact kernel and Android version ranges
Fixed in
- Security patch level 2026-11-05 or later, per the Pixel Update Bulletin November 2026 (coverage of CVE-2026-58809 in the full table not yet confirmed)
- Unknown: specific fixed kernel versions
Workaround
Unknown. No vendor workaround or mitigation has been published.
Exploitation
- Exploited in the wild: none known
- Public proof of concept: none found
- CISA KEV: not listed according to a third-party tracker; not verified directly
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Install the November 2026 update with patch level 2026-11-05 or later on all managed Android devices
- Check the patch level of managed devices and prioritise devices that still receive updates
- Retire or isolate unsupported devices such as Pixel 6 and 6 Pro
- Verify in the full Pixel Update Bulletin whether CVE-2026-58809 is listed
- Re-check NVD for the official CVSS score and affected versions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Pixel Update Bulletin November 2026 source.android.com
- CVE Record CVE-2026-58809 www.cve.org
- Strix CVE-2026-58809 www.strix.ai
- Digital Citizen: November 2026 Pixel drop www.digitalcitizen.life
- WhySoGeek: Android November 2026 security patch whysogeek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:23.
Original description (NVD)
In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.