ASB-A-499350302

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-499350302.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-499350302
Aliases
Published
2026-09-01T00:00:00Z
Modified
2026-09-11T15:42:03Z
Summary
[none]
Details

In multiple functions of llcp_core.c, there is a possible use after free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-09-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
        "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6"
    ],
    "severity": "Critical",
    "spl": "2026-09-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "117597251946018665437928112260239859167",
                    "338763405237872142823783041372701021663",
                    "154213996783463988405856516206226229598",
                    "269161372471386964323475628739212820532",
                    "129732957878471811082413397089705113020",
                    "338763405237872142823783041372701021663",
                    "112092666315829322309908032682660975779",
                    "258962036401738939344496397501781392381"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-499350302-15120381",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
            "target": {
                "file": "net/nfc/llcp_core.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "227705798164377512225297760055285324836",
                "length": 1617
            },
            "id": "ASB-A-499350302-198e9167",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6",
            "target": {
                "file": "net/nfc/llcp_core.c",
                "function": "nfc_llcp_recv_hdlc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "227705798164377512225297760055285324836",
                "length": 1617
            },
            "id": "ASB-A-499350302-64982fb7",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
            "target": {
                "file": "net/nfc/llcp_core.c",
                "function": "nfc_llcp_recv_hdlc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "206633983744377399509200545532643680025",
                "length": 766
            },
            "id": "ASB-A-499350302-8faf8831",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6",
            "target": {
                "file": "net/nfc/llcp_core.c",
                "function": "nfc_llcp_recv_disc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "117597251946018665437928112260239859167",
                    "338763405237872142823783041372701021663",
                    "154213996783463988405856516206226229598",
                    "269161372471386964323475628739212820532",
                    "129732957878471811082413397089705113020",
                    "338763405237872142823783041372701021663",
                    "112092666315829322309908032682660975779",
                    "258962036401738939344496397501781392381"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-499350302-a9a48882",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6",
            "target": {
                "file": "net/nfc/llcp_core.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "206633983744377399509200545532643680025",
                "length": 766
            },
            "id": "ASB-A-499350302-f28c98bb",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
            "target": {
                "file": "net/nfc/llcp_core.c",
                "function": "nfc_llcp_recv_disc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499350302.json"