ASB-A-440544812

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-440544812.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-440544812
Aliases
Published
2026-03-01T00:00:00Z
Modified
2026-03-10T17:06:09.438720Z
Summary
[none]
Details

In multiple locations, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-03-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "severity": "High",
    "spl": "2026-03-05",
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859",
        "https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155"
    ],
    "vanir_signatures": [
        {
            "id": "ASB-A-440544812-0dd51c5f",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "170508798166172314097597771353826620430",
                    "89342480764029246621056754936418984144",
                    "248220330052947097772732175895273315012",
                    "249915814839611507282989559303303507484"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/tls/tls.h"
            },
            "source": "https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-1088cf5f",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "226789466788195715266226247721324978635",
                    "144738273004732636692222213719682687030",
                    "58658334836049400729999299682353487934",
                    "190429337757357799360445297747204015086",
                    "315649370303442028950751356011208452455",
                    "303256381557469460551095301393341350636",
                    "58761924555323761458855217903038601454",
                    "63723652160737214137071628994587564734",
                    "16685416554596044550613339127645693179",
                    "318534184604709186115691318075725179658",
                    "260279685781214014396767371971266917893",
                    "65084346358647903366604779303693785078",
                    "253424568446679716004343652798105549446"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/tls/tls_strp.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-10fc3e80",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "226789466788195715266226247721324978635",
                    "144738273004732636692222213719682687030",
                    "58658334836049400729999299682353487934",
                    "190429337757357799360445297747204015086",
                    "315649370303442028950751356011208452455",
                    "303256381557469460551095301393341350636",
                    "58761924555323761458855217903038601454",
                    "63723652160737214137071628994587564734",
                    "16685416554596044550613339127645693179",
                    "318534184604709186115691318075725179658",
                    "260279685781214014396767371971266917893",
                    "65084346358647903366604779303693785078",
                    "253424568446679716004343652798105549446"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/tls/tls_strp.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-56ff753a",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "284671514526104341197031149636661347225",
                    "172083881392321770836369430485016121290",
                    "244901425473858676203972010086032968956",
                    "125587834902297792702560988887903907419"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/tls/tls_sw.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-72227ff5",
            "signature_type": "Function",
            "digest": {
                "function_hash": "91592170196266127229216292152298278232",
                "length": 514.0
            },
            "target": {
                "file": "net/tls/tls_strp.c",
                "function": "tls_strp_msg_load"
            },
            "source": "https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-72f35f75",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "284671514526104341197031149636661347225",
                    "172083881392321770836369430485016121290",
                    "244901425473858676203972010086032968956",
                    "125587834902297792702560988887903907419"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/tls/tls_sw.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-87c29c16",
            "signature_type": "Function",
            "digest": {
                "function_hash": "77474952819869977334046236629670671947",
                "length": 1040.0
            },
            "target": {
                "file": "net/tls/tls_sw.c",
                "function": "tls_rx_rec_wait"
            },
            "source": "https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-96d8d67c",
            "signature_type": "Function",
            "digest": {
                "function_hash": "77474952819869977334046236629670671947",
                "length": 1040.0
            },
            "target": {
                "file": "net/tls/tls_sw.c",
                "function": "tls_rx_rec_wait"
            },
            "source": "https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-e3ab5908",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "170508798166172314097597771353826620430",
                    "89342480764029246621056754936418984144",
                    "248220330052947097772732175895273315012",
                    "249915814839611507282989559303303507484"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/tls/tls.h"
            },
            "source": "https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859",
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "id": "ASB-A-440544812-e3ef827c",
            "signature_type": "Function",
            "digest": {
                "function_hash": "91592170196266127229216292152298278232",
                "length": 514.0
            },
            "target": {
                "file": "net/tls/tls_strp.c",
                "function": "tls_strp_msg_load"
            },
            "source": "https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155",
            "signature_version": "v1",
            "deprecated": false
        }
    ],
    "types": [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-440544812.json"