CVE-2026-58846: KVM IOMMU Use After Free Vulnerability

CVE-2026-58846 Overview

CVE-2026-58846 is a use-after-free vulnerability in the Android kernel's IOMMU (Input-Output Memory Management Unit) subsystem. The flaw resides in the kvm_iommu_map_sg function inside iommu.c and stems from a missing permission check. A local attacker with low privileges can trigger the condition to achieve escalation of privilege on affected Android devices. Exploitation requires no user interaction and no additional execution privileges. The issue was addressed in the Android Security Bulletin for September 2026 via a patch to the common kernel tree.

Critical Impact
Local attackers can escalate privileges to kernel-level execution without user interaction, undermining the Android sandbox and platform trust boundaries.

Affected Products

Android common kernel (KVM IOMMU code path in iommu.c)
Android devices tracked by the September 2026 Android Security Bulletin
Downstream Android distributions inheriting the affected kernel commit

Discovery Timeline

2026-09-08 - CVE-2026-58846 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database
September 2026 - Fix referenced in the Android Security Bulletin September 2026

Technical Details for CVE-2026-58846

Vulnerability Analysis

The defect is a use-after-free (UAF) in kvm_iommu_map_sg, a routine that maps scatter-gather (SG) lists into IOMMU-managed I/O address spaces for KVM guests. Because a required permission check is missing, execution proceeds along a path that dereferences an object after it has been released. An attacker running unprivileged local code can drive the kernel into this state and reclaim the freed allocation with attacker-controlled data. The weakness is categorized as improper privilege management [CWE-269], which explains why authorization state is not consistently enforced before object lifetime operations. Successful exploitation yields kernel-mode code execution, breaking Android's process isolation and SELinux boundaries.

Root Cause

The missing permission check in kvm_iommu_map_sg allows a caller to reach a code path that operates on an IOMMU-mapped object whose backing memory has already been released. Under concurrent invocation, a subsequent allocation can occupy the freed slot, producing a classic use-after-free primitive. The upstream fix is available as Android Kernel Commit ad34d15.

Attack Vector

Exploitation is local. An attacker needs the ability to execute code on the device, such as through an installed application or a compromised low-privilege process. No user interaction is required. The attacker invokes the vulnerable KVM/IOMMU code path with crafted parameters, races object lifetimes, then leverages the freed allocation to corrupt kernel structures. Successful chains typically escalate to kernel root with the ability to disable SELinux and access protected user data.

Detailed exploitation code is not publicly available. Refer to the Android Kernel Commit for the corrective change and affected code paths.

Detection Methods for CVE-2026-58846

Indicators of Compromise

Unexpected kernel oops or panic traces referencing kvm_iommu_map_sg or IOMMU mapping routines in iommu.c
KASAN or SLUB debug reports flagging use-after-free within the IOMMU subsystem
Unprivileged processes spawning shells or acquiring UID 0 without a legitimate su transition
Runtime SELinux enforcement state changes or unexpected policy reloads

Detection Strategies

Compare installed Android security patch level against the September 2026 bulletin baseline across the mobile fleet
Enable KASAN in test builds to surface use-after-free conditions in the IOMMU code path during QA
Monitor kernel log ring buffers (dmesg, logcat -b kernel) for repeated faults in IOMMU functions
Alert on privilege transitions on managed devices where an app process suddenly executes with elevated capabilities

Monitoring Recommendations

Ingest mobile telemetry and kernel crash reports into a centralized analytics pipeline for correlation
Track application install events for known abusers of KVM or virtualization primitives on user devices
Baseline normal IOMMU mapping activity per device profile and alert on statistical anomalies
Feed Android bulletin patch-level compliance into vulnerability management dashboards

How to Mitigate CVE-2026-58846

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) on all managed devices
Update kernel builds to include commit ad34d15396568919a8ddd306ce2120e76d111b7c from the Android common kernel
Enforce mobile device management (MDM) policies that block enrollment of devices below the required patch level
Restrict sideloading and untrusted application installations on high-risk user populations

Patch Information

The upstream fix is published in the Android common kernel repository as commit ad34d15 and referenced by the Android Security Bulletin September 2026. Device vendors ship the fix as part of their monthly security patch level. Confirm the security patch level via Settings > About phone > Android security update on end-user devices.

Workarounds

No official workaround exists; installing the vendor-supplied patch is the only reliable remediation
Reduce exposure by limiting installation of untrusted third-party applications until patched
Where possible, disable or restrict KVM-based virtualization features on devices that do not require them
Segment sensitive workloads onto devices confirmed to be at the September 2026 patch level or later

bash

# Verify Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later