{"id":"CVE-2026-58942","published":"2026-11-02T20:17:51.170","lastModified":"2026-11-03T05:18:48.757","description":"In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f","tags":[]},{"url":"https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","tags":[]},{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in the do_fault_around function in memory.c allows local attackers to escalate privileges due to a logic error that frees memory while still referencing it, without requiring user interaction or additional privileges.","exploitability":"Exploitation requires local access and is non-trivial due to the need to precisely trigger the use-after-free condition, but no user interaction or elevated privileges are required.","blast_radius":"Successful exploitation could allow a local attacker to gain full system control, compromising confidentiality, integrity, and availability of the affected system.","remediation":"Apply the vendor patch for kernel version X.Y.Z (if specified); if no fixed version is published, disable memory mapping features involving fault handling or restrict access to the affected subsystem until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","privilege-escalation","local-exploit","kernel"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:05:55.489Z"}}