ASB-A-496996374
See a problem?- Import Source
- https://storage.googleapis.com/android-osv/ASB-A-496996374.json
- JSON Data
- https://api.osv.dev/v1/vulns/ASB-A-496996374
- Aliases
-
- A-496996374
- CVE-2026-58828
- Published
- 2026-11-01T00:00:00Z
- Modified
- 2026-11-02T16:56:21Z
- Summary
- [none]
- Details
-
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- References
-
- https://source.android.com/security/bulletin/2026-11-01
- https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec
- https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527
- https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf
- https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471
Affected packages
Android / :linux_kernel:
Package
- Name
- :linux_kernel:
Ecosystem specific
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471"
],
"severity": "High",
"spl": "2026-11-05",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "121190633109205899953018928365355650915",
"length": 594
},
"id": "ASB-A-496996374-11302d16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/proc/base.c",
"function": "proc_dmabuf_rss_hwm_write"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144936424875811636287705786150353673968",
"193640744968449661777083207105905809137",
"299896499794028104631689595446669035771",
"272432629865637191856611218803271151597",
"226390761541095895755253361876323722126",
"20559885785573028659648299800603450754",
"95318548099141040220293266080406827492",
"43737509820338364094733693070923175191",
"234009470208959458936162923735511832639",
"156181208561615064087611977908795030348",
"280203882091208619254828442542974097533",
"278117699771744405403186539691044548754",
"85237824290835710938022198621082637090",
"237769578407080893830962575730478284535",
"268120321645251405815550883375355122918",
"167192486604112899205519650290982623893",
"97046674405439118081313886115130327206",
"180140536229288444871721167892889970230",
"198381673266873547147269856251311294816",
"268513839978389749064880895872826681835"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-1ed11a49",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"target": {
"file": "drivers/dma-buf/dma-buf.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78786539497702727321237285770681435775",
"280139830888195220900443992078443695244",
"17346355164411878187150541093664590268",
"224020872850687490997946507700089308464"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-21f247cb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"target": {
"file": "fs/exec.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "248059202061468838994410823473711354318",
"length": 1422
},
"id": "ASB-A-496996374-4861ee48",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"target": {
"file": "drivers/dma-buf/dma-buf.c",
"function": "dma_buf_begin_new_exec"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189961905232342297289362512273965597249",
"length": 896
},
"id": "ASB-A-496996374-4cc3de8c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"target": {
"file": "drivers/dma-buf/dma-buf.c",
"function": "copy_dmabuf_info"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "271260972701587667592849511978718897271",
"length": 281
},
"id": "ASB-A-496996374-5b2d9a14",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/proc/base.c",
"function": "proc_dmabuf_rss_show"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "58540592252209991772233641989165951864",
"length": 2462
},
"id": "ASB-A-496996374-5f8d39b7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"target": {
"file": "fs/exec.c",
"function": "begin_new_exec"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"150897546058855192822105379004755775362",
"306471992944050290386750344091053770877",
"286314856623747736969668499873686025141",
"67686813509375155867739506828129164153",
"38791968758714814023245013737070621734",
"8518798096083093472433927346636057565",
"55524714265381825010954543508492964730",
"182310298788695267619671647516524666990"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-6e2700bf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"target": {
"file": "include/linux/dma-buf.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"131975753623824420162687009935328382818",
"162137633766565095693676351096445901037",
"32789971619356297414089250503443553533",
"200649329229004990207066373882049795879",
"298368871858772042581334382338036996444",
"254574555862376300625671641626990281221",
"222045387507894336046347054555806903586",
"2408186557196166866561335840006688382",
"131227709707329527017193425109498863248"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-8af51bb9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/file.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144936424875811636287705786150353673968",
"193640744968449661777083207105905809137",
"299896499794028104631689595446669035771",
"272432629865637191856611218803271151597",
"226390761541095895755253361876323722126",
"20559885785573028659648299800603450754",
"95318548099141040220293266080406827492",
"43737509820338364094733693070923175191",
"234009470208959458936162923735511832639",
"156181208561615064087611977908795030348",
"280203882091208619254828442542974097533",
"278117699771744405403186539691044548754",
"85237824290835710938022198621082637090",
"237769578407080893830962575730478284535",
"268120321645251405815550883375355122918",
"167192486604112899205519650290982623893",
"97046674405439118081313886115130327206",
"180140536229288444871721167892889970230",
"198381673266873547147269856251311294816",
"268513839978389749064880895872826681835"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-94020c95",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"target": {
"file": "drivers/dma-buf/dma-buf.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "136469235886032324486746894507336076993",
"length": 1443
},
"id": "ASB-A-496996374-94e85d55",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"target": {
"file": "drivers/dma-buf/dma-buf.c",
"function": "dma_buf_begin_new_exec"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189961905232342297289362512273965597249",
"length": 896
},
"id": "ASB-A-496996374-9ba9406b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"target": {
"file": "drivers/dma-buf/dma-buf.c",
"function": "copy_dmabuf_info"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "143809144763114874850666550851923264010",
"length": 2662
},
"id": "ASB-A-496996374-9c24c8bc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"target": {
"file": "fs/exec.c",
"function": "begin_new_exec"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"205457595181696799063232546860476232689",
"103243046092815755453484235521246321604",
"221767705692847563287911724819457333984",
"308490989939033244539268263493676286",
"326603831601775049067050821127060541334",
"133743730637042434718245541132060346930",
"102690074702297272000825115544846209448",
"130887867609847948976152231101798961851",
"147212790168001947482556077408503083417",
"15895565140645480901922466084841117879",
"129030590312784188693838291227564676164",
"144570105669548695196431982563624401688",
"320212961159511146954905964358663201192",
"205073558504130261126600206343989803656",
"17592154405326111016054138358863234504",
"187653607181258467555659737142638140818",
"75253645107116207764080428742058374419",
"202890410140974152092826948666837156872",
"166785272356280755627241846045533350888",
"311468361170004182952629208524858680975",
"155114514182380041416295704600821267226",
"220516774844930688962829667144673575289",
"829114396436236611439531111316975696",
"63029633312844925762211410757321529092",
"138841833405423142034008974247164578310",
"174940105529124051924532248171946297485",
"205867656050941598634302320153673469178",
"196252513212567354489694540348366582483",
"124894619014030146421407342864793345825",
"314193527500390939716097177447025190841",
"254650944108796244555409426822525270851",
"248753202264697735093549444896814987420",
"199719892909004446771714948613705010901",
"134408722328050922849706416102781630913",
"186859026706520108085868455850815054906",
"183078112883946983001824338811911419035",
"134508974508821255601391485548780497101",
"325369267095775560093735489860683322148",
"4072186091109265168197235197156565483",
"240041502979313409825967993874439979852",
"99495343667143400627788758879337524921",
"46405056100023397418190771102364671374",
"44594906358008386509241511775963084800",
"76999258547185503417883516457065795147",
"6711032115353364449709433140377279772",
"132404261783289554030836036015584001256",
"20273857640975413189028029618700603674",
"309061479344305652406942526283293732267",
"222281025600138647922102451156284187362",
"198184730594064549605192615355663081036",
"297097779157952486398537049973228635149"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-b1727494",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/proc/base.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "143326892560020181287838206324621205155",
"length": 1431
},
"id": "ASB-A-496996374-c0b8f872",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "drivers/dma-buf/dma-buf.c",
"function": "dma_buf_begin_new_exec"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287285015384535246708137527890147774352",
"length": 419
},
"id": "ASB-A-496996374-c8129159",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/proc/base.c",
"function": "proc_dmabuf_rss_hwm_show"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"150897546058855192822105379004755775362",
"306471992944050290386750344091053770877",
"286314856623747736969668499873686025141",
"67686813509375155867739506828129164153",
"38791968758714814023245013737070621734",
"8518798096083093472433927346636057565",
"55524714265381825010954543508492964730",
"182310298788695267619671647516524666990"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-d49ffde4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec",
"target": {
"file": "include/linux/dma-buf.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78786539497702727321237285770681435775",
"280139830888195220900443992078443695244",
"17346355164411878187150541093664590268",
"224020872850687490997946507700089308464"
],
"threshold": 0.9
},
"id": "ASB-A-496996374-d7052050",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf",
"target": {
"file": "fs/exec.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "317454051753243813188455259495752872078",
"length": 841
},
"id": "ASB-A-496996374-d810900d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/file.c",
"function": "__close_range"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "108185142787900855411445728845277365477",
"length": 565
},
"id": "ASB-A-496996374-ea1a1ceb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527",
"target": {
"file": "fs/proc/base.c",
"function": "proc_dmabuf_pss_show"
}
}
]
}