CVE-2026-58695: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-58695 Overview

CVE-2026-58695 is a local privilege escalation vulnerability in the Android gmc_phy_lp3_exit_restore_registers function within phy_power.c. The flaw stems from a missing bounds check, classified as [CWE-120] Buffer Copy without Checking Size of Input. Successful exploitation grants an attacker code execution with System privileges. No user interaction is required, and the attack executes locally on the affected device. The issue was disclosed in the Android Security Bulletin for September 2026.

Critical Impact

A local attacker with low privileges can escalate to System execution privileges without user interaction, compromising confidentiality, integrity, and availability of the device.

Affected Products

• Android platform component phy_power.c (function gmc_phy_lp3_exit_restore_registers)
• Pixel devices covered by the September 2026 Android Security Bulletin
• Downstream Android builds incorporating the vulnerable PHY power management code

Discovery Timeline

• 2026-09-15 - CVE-2026-58695 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-58695

Vulnerability Analysis

The vulnerability resides in gmc_phy_lp3_exit_restore_registers, a routine in phy_power.c responsible for restoring physical layer (PHY) register state during low-power state 3 (LP3) exit. The function processes register data without validating the size or index of input against destination buffer bounds. An attacker able to influence the register restore data can trigger an out-of-bounds write inside a privileged execution context.

Because the code path executes with System privileges, a successful write corrupts adjacent memory used by the kernel or system service. This corruption can be shaped into arbitrary code execution or targeted data tampering. Exploitation requires only local access and existing low-privilege code execution on the device.

Root Cause

The root cause is a missing bounds check on data consumed during the LP3 exit register restore sequence. The function trusts caller-supplied or state-supplied size and offset values, allowing writes beyond the intended buffer. This maps to [CWE-120] Buffer Copy without Checking Size of Input, a classic memory corruption pattern in low-level power management code.

Attack Vector

An attacker requires local access to the device and the ability to run code at a low privilege level. By invoking the code path that triggers gmc_phy_lp3_exit_restore_registers with crafted state, the attacker writes controlled data outside the intended buffer. The write occurs in a System-privileged context, enabling privilege escalation without any user interaction. Refer to the Android Security Bulletin September 2026 for component-level technical details.

Detection Methods for CVE-2026-58695

Indicators of Compromise

• Unexpected crashes or kernel panics referencing phy_power or PHY register restore routines
• Processes running with System UID that were spawned from unprivileged application contexts
• Anomalous writes to kernel memory regions adjacent to PHY register buffers observed in device logs

Detection Strategies

• Monitor logcat and kernel ring buffer output for faults in gmc_phy_lp3_exit_restore_registers or nearby symbols
• Correlate device power state transitions (LP3 entry/exit) with subsequent privilege changes
• Track installation of unsigned or side-loaded applications that request low-level hardware or power management interfaces

Monitoring Recommendations

• Enroll devices in mobile threat defense tooling that inspects kernel-level anomalies and privilege transitions
• Alert on Android Security Patch Level values older than 2026-09-01 across the managed fleet
• Baseline normal PHY power management behavior and flag deviations during device audit reviews

How to Mitigate CVE-2026-58695

Immediate Actions Required

• Apply the September 2026 Android security patch (patch level 2026-09-01 or later) to all affected devices
• Restrict installation of untrusted applications that could stage a local exploit
• Enforce mobile device management policies that block devices running vulnerable patch levels from accessing enterprise resources

Patch Information

Google addressed CVE-2026-58695 in the September 2026 Android Security Bulletin. Devices with a Security Patch Level of 2026-09-01 or later contain the fix. Consult the Android Security Bulletin September 2026 for device-specific update guidance and OEM release timing.

Workarounds

• No official workaround is published; patching is the only supported remediation
• Reduce risk exposure by limiting local access to devices and disallowing developer options on production endpoints
• Segment vulnerable devices from sensitive workloads until the vendor patch is applied