# CVE-2026-59048: Android Kernel out-of-bounds read in KVM trace buffer initialization

Source: https://junglewise.ai/threats/cve-2026-59048-in-rb-cpu-init-of-trace-c-there-is-a-possible-out-of-bounds-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-59048 · Severity: info · Published 2026-11-02

The Android kernel's KVM hypervisor contains a vulnerability in trace buffer initialization on ARM64 systems that could allow a local user to read sensitive kernel memory. The flaw occurs due to incorrect bounds checking when setting up CPU trace buffers, potentially exposing information about kernel internals or other running processes.

Technologies: [Google Android kernel](https://junglewise.ai/threats/technologies/google-android-kernel). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-59048 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59048 being exploited in the wild.

**How severe is CVE-2026-59048?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Google Android kernel unspecified.

**Is there a fix for CVE-2026-59048?** Yes: fixed in Android Kernel commit 5e31aa53a963b254ddac8a88b48e5b64cfc38eea and e46b3a946c957ab463a8abf9333dea702e8a485e. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59048 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-59048?** Check whether you run Google Android kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Android Kernel commit 5e31aa53a963b254ddac8a88b48e5b64cfc38eea and e46b3a946c957ab463a8abf9333dea702e8a485e

## Technical details

An out-of-bounds read vulnerability exists in rb_cpu_init within the KVM trace subsystem (arch/arm64/kvm/hyp/nvhe/trace.c) caused by an incorrect bounds check. The vulnerability occurs when an error happens during cpu_buffer initialization; if nr_pages does not accurately reflect the number of allocated pages, the teardown path may access memory beyond the allocated region. A local attacker with no special privileges can exploit this to leak kernel memory.

## Affected products

- Google Android Kernel unspecified

## Timeline

- 2026-05-15: patched

## References

- [https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea](https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea)
- [https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e](https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e)

## Related threats

- [Android kernel SMMU stale TLB entry escalation](https://junglewise.ai/threats/cve-2026-56930-in-smmu-find-ste-of-smmu-c-there-is-a-possible-way-to-retain)
- [Android Kernel KVM race condition memory corruption](https://junglewise.ai/threats/cve-2026-59045-in-multiple-locations-there-is-a-possible-memory-corruption-due)
- [Android kernel out-of-bounds write in pKVM MMU race condition](https://junglewise.ai/threats/cve-2026-59042-in-pkvm-pages-to-ppages-of-mmu-c-there-is-a-possible-out-of)
- [Android kernel integer overflow in VMA padding](https://junglewise.ai/threats/cve-2026-58845-in-multiple-locations-there-is-a-possible-out-of-bounds-write-due)
- [Android kernel out-of-bounds read/write in IOMMU](https://junglewise.ai/threats/cve-2026-58844-in-multiple-locations-there-is-a-possible-out-of-bounds-read)