ASB-A-432751421

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-432751421.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-432751421
Aliases
Published
2025-12-01T00:00:00Z
Modified
2025-12-12T17:34:10.195021Z
Summary
[none]
Details

In multiple functions of eventpoll.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2025-12-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "spl": "2025-12-05",
    "vanir_signatures": [
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4",
            "id": "ASB-A-432751421-07f881bd",
            "digest": {
                "function_hash": "225272087380341930722764372070177932387",
                "length": 980.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "__ep_remove"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4",
            "id": "ASB-A-432751421-09c27d3c",
            "digest": {
                "function_hash": "193742352529799999018054022901653944807",
                "length": 476.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "eventpoll_release_file"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4",
            "id": "ASB-A-432751421-1187aa3f",
            "digest": {
                "function_hash": "302585684081311364259973594735594056069",
                "length": 109.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "ep_remove_safe"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d",
            "id": "ASB-A-432751421-15d3c249",
            "digest": {
                "function_hash": "302585684081311364259973594735594056069",
                "length": 109.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "ep_remove_safe"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4",
            "id": "ASB-A-432751421-37bd2f54",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "191086137022076412654719601900755324637",
                    "305880740741489180353900614106308834343",
                    "156354163012597448717876851313346644374",
                    "43133606676216229872366682582595430577",
                    "53680982208576432672483418914650228635",
                    "143084532597701593378095613599655973036",
                    "245259190946504012864677613054117331229",
                    "185163040645222305081070194719032503973",
                    "275426261501251460314004956379080083057",
                    "22230450026473659538222166346120204230",
                    "198239684236587095227658438206885406496",
                    "264886695460970654656505020233803929826",
                    "156246689978767029069455274798735238302",
                    "96310133543355706759918774982179183095",
                    "71581205124471488349769021492195145642",
                    "124668659825270235954482475400933640404",
                    "338749947511906827518898661969395561128",
                    "338800242697408465896954949919072303267",
                    "52851446014308305584998005002837404056",
                    "188669672070099765290301194341975930854",
                    "219856154056342786804513759120734090660",
                    "153684431549941401248837892446231039374",
                    "52003684389434483397801170239171013421",
                    "79341163529413239514464459628078193806"
                ]
            },
            "target": {
                "file": "fs/eventpoll.c"
            },
            "signature_version": "v1",
            "signature_type": "Line"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d",
            "id": "ASB-A-432751421-38377723",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "99707066724420952802937730033197315754",
                    "76782040879425346743140689371658564088",
                    "156354163012597448717876851313346644374",
                    "43133606676216229872366682582595430577",
                    "53680982208576432672483418914650228635",
                    "143084532597701593378095613599655973036",
                    "245259190946504012864677613054117331229",
                    "185163040645222305081070194719032503973",
                    "275426261501251460314004956379080083057",
                    "22230450026473659538222166346120204230",
                    "198239684236587095227658438206885406496",
                    "264886695460970654656505020233803929826",
                    "156246689978767029069455274798735238302",
                    "96310133543355706759918774982179183095",
                    "71581205124471488349769021492195145642",
                    "124668659825270235954482475400933640404",
                    "338749947511906827518898661969395561128",
                    "338800242697408465896954949919072303267",
                    "52851446014308305584998005002837404056",
                    "321089779111838009070075004849469478841",
                    "219856154056342786804513759120734090660",
                    "153684431549941401248837892446231039374",
                    "52003684389434483397801170239171013421",
                    "79341163529413239514464459628078193806"
                ]
            },
            "target": {
                "file": "fs/eventpoll.c"
            },
            "signature_version": "v1",
            "signature_type": "Line"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d",
            "id": "ASB-A-432751421-987c1f0b",
            "digest": {
                "function_hash": "57695190440068655440460860376309819076",
                "length": 611.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "ep_clear_and_put"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d",
            "id": "ASB-A-432751421-aee69f0d",
            "digest": {
                "function_hash": "50291707803570425513963959457156653771",
                "length": 962.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "__ep_remove"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4",
            "id": "ASB-A-432751421-be9b8a64",
            "digest": {
                "function_hash": "57695190440068655440460860376309819076",
                "length": 611.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "ep_clear_and_put"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "source": "https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d",
            "id": "ASB-A-432751421-e8422835",
            "digest": {
                "function_hash": "193742352529799999018054022901653944807",
                "length": 476.0
            },
            "target": {
                "file": "fs/eventpoll.c",
                "function": "eventpoll_release_file"
            },
            "signature_version": "v1",
            "signature_type": "Function"
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4",
        "https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d"
    ],
    "types": [
        "EoP"
    ]
}