ASB-A-499041514

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-499041514.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-499041514
Aliases
Published
2026-11-01T00:00:00Z
Modified
2026-11-05T16:32:28Z
Summary
[none]
Details

In multiple functions of compress.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a",
        "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
        "https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f",
        "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8"
    ],
    "severity": "High",
    "spl": "2026-11-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "55989782831528650047615861070583905681",
                "length": 653
            },
            "id": "ASB-A-499041514-0a6df951",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_compress_write_end_io"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "23911516186151812126285498025494064902",
                "length": 4838
            },
            "id": "ASB-A-499041514-16e61a7c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_write_compressed_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "217992329313013624045017860555906211598",
                "length": 182
            },
            "id": "ASB-A-499041514-21919c62",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_init_compress_ctx"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "89999943499741124249131594334031796243",
                "length": 309
            },
            "id": "ASB-A-499041514-299615ec",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "page_array_free"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "270266926901652386660951561374926219100",
                "length": 4548
            },
            "id": "ASB-A-499041514-2b927b89",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_write_compressed_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "175260826828192608557161547606205714801",
                "length": 730
            },
            "id": "ASB-A-499041514-3df8e609",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_free_dic"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "311872153156619657418855753991177303583",
                "length": 281
            },
            "id": "ASB-A-499041514-4c82007b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_destroy_compress_ctx"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "251009063058845828252660541478974075106",
                "length": 851
            },
            "id": "ASB-A-499041514-4f827997",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_prepare_decomp_mem"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "93460549504009682191912378729076492705",
                    "224997850459333721217930266823868768376",
                    "108394170236598334515011525127368199952",
                    "73407920136660074807641638594056349301",
                    "85259503849476585494467864802635604648",
                    "73960982417743782689057887345318705352",
                    "221187607062658494155917976150010871027",
                    "297865325927233622517502042533006007351",
                    "158060336519898321496091760771395137466",
                    "215902774869814679395835049662761056010",
                    "160787077589459841717200307841532377950",
                    "146545757902991409975762709052182917144",
                    "136361577883117483296541222324128330352",
                    "56774226496245608213720188899083780925",
                    "304540044565540693201118420261884696190",
                    "103922071390217792232731095636326004417",
                    "86617388808543488709773053775821771721",
                    "13501644020507883265459618309817100831",
                    "217055680356673693475784359801473361125",
                    "295025064466402099658419888497216795137",
                    "23946388176418599826853943084394685888",
                    "226731997445325069769269514614338037757",
                    "47156568707413185019407279867207197228",
                    "71007857242565876589781318263452524327",
                    "33090005617681991691656027794180715864",
                    "235373163432968113344524184096267991229",
                    "125300827626469622076928128316107576202",
                    "295569588323743102613203100475051857177",
                    "214091499376293322078611410850926201817",
                    "52089497547971689712973718766592706247",
                    "307854274376171639293967478132548426675",
                    "190971648158080309913330221389997773125",
                    "275595207755636872868568948716933840696",
                    "193886980122259632568323596240589665047",
                    "32960796816410092906706022681035467564",
                    "275776125343405168916396249103728464346",
                    "45049995380888848386338564909601376530",
                    "278456286985633661043559506886268395713",
                    "134217034112164692444034510752471178346",
                    "63258575288145943258726758251651182470",
                    "280909747180340945901701154650345555935",
                    "154318887464097148665693902491409355059",
                    "101832203030179593893610650727447834237",
                    "164283006494565440392648571056447867819",
                    "248036362135899575461256789287317014291",
                    "89619546740184721779774959992603152204",
                    "17328220882884752172771821575753280880",
                    "171121164603025888847593109612752073483",
                    "33035549135137412476696809515293895463",
                    "215676072124937206262999583590400174776",
                    "150272259434584903717115481858990392299",
                    "62696146518608760450107075380298017534",
                    "335828030662545615120496887131186234989",
                    "285820217966258463300457884922270893611",
                    "144594620530619122640062203041724556463",
                    "27985751609344219411959209513634350509",
                    "132182085740897500616171402596253460408",
                    "201768301399365923569497588698760923273",
                    "182819048257112723666670872697815489838",
                    "169582387209919031267233374714623647423",
                    "311391021797510888953578728583721058099",
                    "103566520647297233712022815899724265759",
                    "87781187794816270176634885004861289094",
                    "291916639781421895268021778430339783839",
                    "6845565008264283804561348070709539247",
                    "203669520578472635099394390906042932406",
                    "91991795871833234658799257913660044257",
                    "147198796877310387518641100729773158576",
                    "132527948710690674047306735591896862491",
                    "216117027442722562394731117148499327069",
                    "2148262813004735668062256435421857901",
                    "128343471797194152033254470755479850780",
                    "34650123701936755770091007842451969438",
                    "307503707082305485727724704283837721778",
                    "83197696444158879292398807104475372170",
                    "124574534566685841162508547725500138249",
                    "280003443339954604532842317926837868283",
                    "319135176963477130401995775777622271578",
                    "165030382898097911025698317283662268855",
                    "216101555042994969487203240894972957597",
                    "258975616685547778089935852365194114421",
                    "74497010644978389685815901564608458109",
                    "283428242774970286570974399582558167362"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-499041514-566d5d10",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "333082025916956055869217765342830451557",
                "length": 2845
            },
            "id": "ASB-A-499041514-59131c6b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_compress_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "218573606822950625434780946916294767108",
                "length": 332
            },
            "id": "ASB-A-499041514-69453a7d",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "page_array_alloc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "175260826828192608557161547606205714801",
                "length": 730
            },
            "id": "ASB-A-499041514-69962f1e",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_free_dic"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "233877380240521296602251489865644179994",
                    "101750652174065166225738253589999607533",
                    "233459712117975445723824233742720596949",
                    "150726952759985247749913167319567998287",
                    "138849840685029282507260403610604460579",
                    "246368886688693307716534080510714125179",
                    "270957124025931039101319385587852202173",
                    "63168310339935631114961416973038311986"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-499041514-77e0bfc6",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a",
            "target": {
                "file": "fs/f2fs/f2fs.h"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "333082025916956055869217765342830451557",
                "length": 2845
            },
            "id": "ASB-A-499041514-85bd32f2",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_compress_pages"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "93460549504009682191912378729076492705",
                    "224997850459333721217930266823868768376",
                    "108394170236598334515011525127368199952",
                    "73407920136660074807641638594056349301",
                    "85259503849476585494467864802635604648",
                    "73960982417743782689057887345318705352",
                    "221187607062658494155917976150010871027",
                    "297865325927233622517502042533006007351",
                    "158060336519898321496091760771395137466",
                    "215902774869814679395835049662761056010",
                    "160787077589459841717200307841532377950",
                    "146545757902991409975762709052182917144",
                    "136361577883117483296541222324128330352",
                    "56774226496245608213720188899083780925",
                    "304540044565540693201118420261884696190",
                    "103922071390217792232731095636326004417",
                    "86617388808543488709773053775821771721",
                    "13501644020507883265459618309817100831",
                    "217055680356673693475784359801473361125",
                    "295025064466402099658419888497216795137",
                    "23946388176418599826853943084394685888",
                    "226731997445325069769269514614338037757",
                    "47156568707413185019407279867207197228",
                    "71007857242565876589781318263452524327",
                    "33090005617681991691656027794180715864",
                    "235373163432968113344524184096267991229",
                    "125300827626469622076928128316107576202",
                    "295569588323743102613203100475051857177",
                    "214091499376293322078611410850926201817",
                    "52089497547971689712973718766592706247",
                    "307854274376171639293967478132548426675",
                    "190971648158080309913330221389997773125",
                    "275595207755636872868568948716933840696",
                    "193886980122259632568323596240589665047",
                    "32960796816410092906706022681035467564",
                    "275776125343405168916396249103728464346",
                    "45049995380888848386338564909601376530",
                    "278456286985633661043559506886268395713",
                    "134217034112164692444034510752471178346",
                    "63258575288145943258726758251651182470",
                    "280909747180340945901701154650345555935",
                    "154318887464097148665693902491409355059",
                    "101832203030179593893610650727447834237",
                    "164283006494565440392648571056447867819",
                    "248036362135899575461256789287317014291",
                    "89619546740184721779774959992603152204",
                    "296473826782694201241433872807614185567",
                    "130953268726245751570369255911423561902",
                    "213898368531657425416258827122841772077",
                    "215676072124937206262999583590400174776",
                    "150272259434584903717115481858990392299",
                    "62696146518608760450107075380298017534",
                    "335828030662545615120496887131186234989",
                    "285820217966258463300457884922270893611",
                    "144594620530619122640062203041724556463",
                    "27985751609344219411959209513634350509",
                    "132182085740897500616171402596253460408",
                    "201768301399365923569497588698760923273",
                    "182819048257112723666670872697815489838",
                    "169582387209919031267233374714623647423",
                    "311391021797510888953578728583721058099",
                    "103566520647297233712022815899724265759",
                    "87781187794816270176634885004861289094",
                    "291916639781421895268021778430339783839",
                    "6845565008264283804561348070709539247",
                    "203669520578472635099394390906042932406",
                    "91991795871833234658799257913660044257",
                    "147198796877310387518641100729773158576",
                    "132527948710690674047306735591896862491",
                    "216117027442722562394731117148499327069",
                    "2148262813004735668062256435421857901",
                    "128343471797194152033254470755479850780",
                    "34650123701936755770091007842451969438",
                    "307503707082305485727724704283837721778",
                    "83197696444158879292398807104475372170",
                    "124574534566685841162508547725500138249",
                    "280003443339954604532842317926837868283",
                    "319135176963477130401995775777622271578",
                    "165030382898097911025698317283662268855",
                    "216101555042994969487203240894972957597",
                    "258975616685547778089935852365194114421",
                    "74497010644978389685815901564608458109",
                    "283428242774970286570974399582558167362"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-499041514-9047115c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "218573606822950625434780946916294767108",
                "length": 332
            },
            "id": "ASB-A-499041514-998e4ed3",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "page_array_alloc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "169199165470287382287496810665069498840",
                "length": 1439
            },
            "id": "ASB-A-499041514-9c5922ff",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_alloc_dic"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "311872153156619657418855753991177303583",
                "length": 281
            },
            "id": "ASB-A-499041514-aa5353a8",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_destroy_compress_ctx"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "68922724091764190891647770106921802004",
                "length": 1513
            },
            "id": "ASB-A-499041514-b69c09c7",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_decompress_cluster"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "251009063058845828252660541478974075106",
                "length": 851
            },
            "id": "ASB-A-499041514-b88edcf5",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_prepare_decomp_mem"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "89999943499741124249131594334031796243",
                "length": 309
            },
            "id": "ASB-A-499041514-ba74b15b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "page_array_free"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "55989782831528650047615861070583905681",
                "length": 653
            },
            "id": "ASB-A-499041514-c760037c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_compress_write_end_io"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "217992329313013624045017860555906211598",
                "length": 182
            },
            "id": "ASB-A-499041514-cf6d90ba",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_init_compress_ctx"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "233877380240521296602251489865644179994",
                    "101750652174065166225738253589999607533",
                    "233459712117975445723824233742720596949",
                    "150726952759985247749913167319567998287",
                    "138849840685029282507260403610604460579",
                    "246368886688693307716534080510714125179",
                    "270957124025931039101319385587852202173",
                    "63168310339935631114961416973038311986"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-499041514-d5af3626",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f",
            "target": {
                "file": "fs/f2fs/f2fs.h"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "169199165470287382287496810665069498840",
                "length": 1439
            },
            "id": "ASB-A-499041514-db8c8569",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8",
            "target": {
                "file": "fs/f2fs/compress.c",
                "function": "f2fs_alloc_dic"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499041514.json"