GrapheneOS 2026110800 patches 96 CVEs including 12 critical Android kernel flaws

Brief written by the FOSSWire AI editor from GrapheneOS How we write

November 8, 2026 2 min read

Key Takeaway

GrapheneOS has shipped a security-focused release bundling six months of Android Security Bulletins and a kernel backport fixing a Pixel suspend accounting bug that worsened after the previous GKI update.

Summary

GrapheneOS released version 2026110800 for Pixel 10 series devices, incorporating all Android 17 security patches from December 2026 through May 2027. The update addresses 96 CVEs total, with 12 rated critical and 84 rated high severity. A kernel backport from Android 17 QPR2 Beta resolves an upstream Pixel suspend accounting bug that became more prevalent following the Generic Kernel Image (GKI) update in the prior 2026110700 release. This bug affected both GrapheneOS and stock Android on Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, and Pixel 10 Pro Fold devices.

The security preview release format allows GrapheneOS to deliver patches ahead of Google's standard monthly cycle, though users should note that 2026110801 is designated as a security preview rather than a stable channel release. The critical CVEs span multiple Android subsystems, while the high-severity batch includes numerous kernel and framework-level vulnerabilities disclosed across the six-month bulletin period.

Security patch scope and kernel fix details

Critical CVEs: Twelve critical-severity vulnerabilities are patched, including CVE-2026-28666, CVE-2026-49921, CVE-2026-58820, CVE-2026-59062, CVE-2026-59069, CVE-2026-104172, and CVE-2027-0001, CVE-2027-0160, CVE-2027-0165, CVE-2027-0212, CVE-2027-0255, CVE-2027-0279.
High-severity CVE volume: Eighty-four high-severity CVEs are addressed, with identifiers ranging from CVE-2025-48654 through multiple 2026 and 2027 series entries covering framework, system, and kernel components.
Kernel suspend accounting fix: The backported fix targets an upstream Pixel bug in suspend/resume accounting that increased in frequency after the GKI update in release 2026110700, affecting power state tracking accuracy.
Security preview channel: The comprehensive patch set ships in release 2026110801, which is explicitly designated as a security preview release with details explained in a separate GrapheneOS post about the preview program.

Why it matters

For mobile Linux and hardened Android users, this release demonstrates GrapheneOS's continued ability to outpace stock Android on security patch velocity by consolidating six months of bulletins into a single update. The kernel suspend fix is particularly relevant for Pixel 10 series users who experienced degraded power management after the recent GKI transition, a shared component with stock Android that underscores the challenges of maintaining stability on Google's newer kernel architecture.

What to do

If you use a Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, or Pixel 10 Pro Fold with GrapheneOS, update to release 2026110800 (or the 2026110801 security preview) to receive the patches.
Watch for the suspend accounting bug fix if you experienced power state tracking issues after the previous 2026110700 release.
Note that 2026110801 is a security preview release, not a stable channel release, so review GrapheneOS's security preview program details before opting in.

Original reference: grapheneos.org →