ASB-A-496407345

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-496407345.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-496407345
Aliases
Published
2026-11-01T00:00:00Z
Modified
2026-11-04T16:48:29Z
Summary
[none]
Details

In remove_waiter of rtmutex.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7",
        "https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6",
        "https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f",
        "https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1"
    ],
    "severity": "High",
    "spl": "2026-11-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "321623487731059697462659176703519390621",
                "length": 753
            },
            "id": "ASB-A-496407345-110d7f34",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6",
            "target": {
                "file": "kernel/locking/rtmutex.c",
                "function": "remove_waiter"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "98042712526789370733806478659557162825",
                    "126676874583107820258592533601385840698",
                    "19642359851191854621195812806741186124",
                    "14609262171748844005021633772876798503"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496407345-22c319b3",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7",
            "target": {
                "file": "kernel/locking/rtmutex_api.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "8865747388681679273238240347913336704",
                "length": 348
            },
            "id": "ASB-A-496407345-393a44ac",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7",
            "target": {
                "file": "kernel/locking/rtmutex_api.c",
                "function": "rt_mutex_start_proxy_lock"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "121474958323146197188754889206337478448",
                "length": 261
            },
            "id": "ASB-A-496407345-751e280f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f",
            "target": {
                "file": "kernel/locking/rtmutex_api.c",
                "function": "rt_mutex_start_proxy_lock"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "321623487731059697462659176703519390621",
                "length": 753
            },
            "id": "ASB-A-496407345-7c808baf",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1",
            "target": {
                "file": "kernel/locking/rtmutex.c",
                "function": "remove_waiter"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "84269936625604621200357597489841864462",
                    "72332967552365167678396858751267270359",
                    "123144722431976731585365432604424527191",
                    "53371536021202348677362757505832586433",
                    "307527933472384961818192845659133641107",
                    "203245035530162826384709227839934427850",
                    "75116793936665624820930136254857920437",
                    "256177438596760873311434396465664240989",
                    "27332636958692321789847883230970156358",
                    "9618425157490490837031240458221865987",
                    "96231594927069690110890544437447439402",
                    "71297725183417811193672019410092583209",
                    "209604960097474086482785295245154164400",
                    "140010148176648859616308240417706375647",
                    "161362430862471991036898901121823974006",
                    "209761725319832223996862197605802485380",
                    "1831840297024962081632188923952264414",
                    "302421641651323288913677140077751470820"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496407345-9610b5e9",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6",
            "target": {
                "file": "kernel/locking/rtmutex.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "84269936625604621200357597489841864462",
                    "72332967552365167678396858751267270359",
                    "123144722431976731585365432604424527191",
                    "53371536021202348677362757505832586433",
                    "307527933472384961818192845659133641107",
                    "203245035530162826384709227839934427850",
                    "75116793936665624820930136254857920437",
                    "256177438596760873311434396465664240989",
                    "27332636958692321789847883230970156358",
                    "9618425157490490837031240458221865987",
                    "96231594927069690110890544437447439402",
                    "71297725183417811193672019410092583209",
                    "209604960097474086482785295245154164400",
                    "140010148176648859616308240417706375647",
                    "161362430862471991036898901121823974006",
                    "209761725319832223996862197605802485380",
                    "1831840297024962081632188923952264414",
                    "302421641651323288913677140077751470820"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496407345-de29bd9c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1",
            "target": {
                "file": "kernel/locking/rtmutex.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "128606081143331584820015410938333341431",
                    "59503128719007975942250479901900872536",
                    "253704620930610164433288176540467167698",
                    "59439083731474349844524076548377312763"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496407345-f92f72fd",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f",
            "target": {
                "file": "kernel/locking/rtmutex_api.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496407345.json"