# CVE-2026-59609: PowerVR GPU kernel use-after-free in fence identifier handling

Source: https://junglewise.ai/threats/cve-2026-59609-in-fence-manager-extract-iif-of-fence-manager-c-there-is-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-59609 · Severity: info · Published 2026-11-10

A use-after-free vulnerability in the PowerVR GPU kernel driver's fence manager can allow a local attacker to corrupt kernel memory through fence identifier reuse, potentially leading to privilege escalation. No special permissions or user interaction are required to exploit this flaw on affected Pixel devices.

Technologies: [Google Pixel Devices](https://junglewise.ai/threats/technologies/pixel-devices). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Imagination Technologies](https://junglewise.ai/threats/vendors/imagination-technologies).

## Quick answers

**Is CVE-2026-59609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59609 being exploited in the wild.

**How severe is CVE-2026-59609?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Google Pixel Devices Versions prior to security patch level 2026-11-05; Imagination Technologies PowerVR GPU Unspecified.

**Is there a fix for CVE-2026-59609?** A patch was published on 2026-11-05: Included in Pixel security patch level 2026-11-05 Until you apply it: Update to Pixel security patch level 2026-11-05 or later to receive the fix for this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59609 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-59609?** Check whether you run Google Pixel Devices or Imagination Technologies PowerVR GPU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Update to Pixel security patch level 2026-11-05 or later to receive the fix for this vulnerability.

## Technical details

The vulnerability exists in fence_manager_extract_iif of fence_manager.c, where fence identifiers are reused without proper cleanup, creating a use-after-free condition. A local attacker with code execution can trigger this to corrupt kernel memory and escalate privileges. The fix is included in the Pixel security patch level 2026-11-05 or later.

## Affected products

- Google Pixel devices Versions prior to security patch level 2026-11-05
- Imagination Technologies PowerVR GPU Unspecified

## Timeline

- 2026-11-10: disclosed
- 2026-11-05: patched: Included in Pixel security patch level 2026-11-05

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01)

## Related threats

- [Google Pixel Face Auth TA privilege escalation in TzPipelineInputExtractor](https://junglewise.ai/threats/cve-2026-59607-in-tzpipelineinputextractor-of-tzpipelineinputextractor-cpp-there)
- [Pixel HWCodec Firmware heap buffer overflow in encoder](https://junglewise.ai/threats/cve-2026-59594-in-spm-alloc-of-encoder-there-is-a-possible-heap-buffer-overflow)
- [Pixel devices out-of-bounds write in graphics execution](https://junglewise.ai/threats/cve-2026-58804-in-executegraphcommand-of-multiple-files-there-is-a-possible-way)
- [ARM SMMU v3 stale stream table entry information disclosure](https://junglewise.ai/threats/cve-2026-58801-in-smmu-domain-config-s1-of-arm-smmu-v3-c-there-is-a-possible-way)
- [Google Pixel hwmgr elevation of privilege via uninitialized data](https://junglewise.ai/threats/cve-2026-58785-in-update-user-consent-of-main-rs-there-is-a-possible-elevation)