ASB-A-499350302

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-499350302.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-499350302
Aliases
Published
2026-09-01T00:00:00Z
Modified
2026-10-02T16:01:02Z
Summary
[none]
Details

In multiple functions of llcp_core.c, there is a possible use after free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-09-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
        "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6"
    ],
    "severity":  "Critical",
    "spl":  "2026-09-05",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "117597251946018665437928112260239859167",
                    "338763405237872142823783041372701021663",
                    "154213996783463988405856516206226229598",
                    "269161372471386964323475628739212820532",
                    "129732957878471811082413397089705113020",
                    "338763405237872142823783041372701021663",
                    "112092666315829322309908032682660975779",
                    "258962036401738939344496397501781392381"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-499350302-15120381",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
            "target":  {
                "file":  "net/nfc/llcp_core.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "227705798164377512225297760055285324836",
                "length":  1617
            },
            "id":  "ASB-A-499350302-198e9167",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6",
            "target":  {
                "file":  "net/nfc/llcp_core.c",
                "function":  "nfc_llcp_recv_hdlc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "227705798164377512225297760055285324836",
                "length":  1617
            },
            "id":  "ASB-A-499350302-64982fb7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
            "target":  {
                "file":  "net/nfc/llcp_core.c",
                "function":  "nfc_llcp_recv_hdlc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "206633983744377399509200545532643680025",
                "length":  766
            },
            "id":  "ASB-A-499350302-8faf8831",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6",
            "target":  {
                "file":  "net/nfc/llcp_core.c",
                "function":  "nfc_llcp_recv_disc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "117597251946018665437928112260239859167",
                    "338763405237872142823783041372701021663",
                    "154213996783463988405856516206226229598",
                    "269161372471386964323475628739212820532",
                    "129732957878471811082413397089705113020",
                    "338763405237872142823783041372701021663",
                    "112092666315829322309908032682660975779",
                    "258962036401738939344496397501781392381"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-499350302-a9a48882",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6",
            "target":  {
                "file":  "net/nfc/llcp_core.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "206633983744377399509200545532643680025",
                "length":  766
            },
            "id":  "ASB-A-499350302-f28c98bb",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32",
            "target":  {
                "file":  "net/nfc/llcp_core.c",
                "function":  "nfc_llcp_recv_disc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499350302.json"