CVE-2026-58844

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567
• https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff
• https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365
• https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7
• https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb
• https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56
• https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd
• https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82
• https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd
• https://source.android.com/docs/security/bulletin/2026/2026-11-01

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58836In handlePackagePostInstall of InstallPackageHelper.java, th…
• CVE-2026-58837In multiple locations, there is a possible background activi…
• CVE-2026-58838In multiple functions of Helpers.java, there is a possible i…
• CVE-2026-58839In forEachLine of MountRegistry.cpp, there is a possible out…7.8
• CVE-2026-5884Insufficient validation of untrusted input in Media in Googl…8.8
• CVE-2026-58841In multiple functions of VirtualAudioControllerTest.java, th…7.8
• CVE-2026-58845In multiple locations, there is a possible out of bounds wri…
• CVE-2026-58846In kvm_iommu_map_sg of iommu.c, there is a possible use afte…7.8
• CVE-2026-58847In kvm_vfio_pviommu_attach of vfio.c, there is a possible do…
• CVE-2026-58848In multiple functions of alloc.c, there is a possible unauth…7
• CVE-2026-5885Insufficient validation of untrusted input in WebML in Googl…6.5
• CVE-2026-58853In multiple functions of ipphelper.c, there is a possible st…