ASB-A-499359964

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-499359964.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-499359964
Aliases
  • A-499359964
  • CVE-2026-58827
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:18Z
Summary
[none]
Details

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67",
        "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"
    ],
    "severity":  "High",
    "spl":  "2026-11-05",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "110119949003007147025732269034498067476",
                "length":  1405
            },
            "id":  "ASB-A-499359964-098af70a",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "dma_buf_begin_new_exec"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "188539048586863725890419097264370020252",
                "length":  1031
            },
            "id":  "ASB-A-499359964-2ab600bd",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "dup_dma_buf_info"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "277603533942831042957838684450805672489",
                    "131335301546573244224465578611784889497",
                    "330546395922362878290460987340422764330",
                    "186428463664412723929277109102780364377",
                    "68062566739193187382204446502280043008",
                    "72769656723554965202482409385968309962",
                    "38424048196255626444130381228031591148",
                    "304184781350158152821097057269691594965",
                    "151625118768689803590014979851687732230",
                    "331130367926654226995620745196390117994",
                    "150710803783458465005863294699009185487",
                    "340178583577228998947660012059471648381",
                    "91957248958510249059222787274901673873",
                    "281195732600067785114343108806129240130",
                    "206980953843095613535268319364595477085",
                    "326683770769006290140298279008026642876",
                    "185905442924254399759205596753210145841",
                    "245430485549501393490080528711126033729",
                    "29695344557455531578645440405051306168",
                    "58849427221100016038019995052542347919",
                    "331175882966102025993177671635638635917",
                    "118204895782943632752166350183493714065",
                    "1119602260907598637456402240494233805",
                    "190455081888449251604094195247424027135",
                    "338344862870060663960570789828293441187",
                    "306527920178083607657668765484659109600",
                    "5173922179103631259361437092914264977",
                    "102415012969978275600873468636652983860",
                    "93959454523220682406630252148637652025",
                    "321541551899181617745674301594112315511",
                    "214007207821586316672526124764442133586",
                    "294909693843627200380987820096383520284",
                    "321270013595618982131078441792431698921",
                    "282807733230106630613711509347927128668",
                    "262035659345876601404956932448352575854",
                    "98474845968899156174544017026988716600",
                    "193006981246506715978661341836466572322",
                    "283827352530074408064833119710169406835",
                    "86083725320611899670925478178621824560",
                    "166348958741955914105068745625470481723",
                    "124153149903163751390572925124905677395",
                    "40643795074385766927239435003604463576",
                    "224241419619181295386641260662036620791",
                    "95176798222403168910570895487200505537",
                    "96622909971711903870980132387947758182",
                    "143492913515266206060493034582173031417",
                    "334956775824397418502850939934351192096",
                    "303117742708575597527481657004126316670",
                    "186899200402398320261080956824820428908",
                    "144925213240813340675833297931077428876",
                    "243647154178170698011337974724886411125",
                    "174681300190455605184537775634796533392",
                    "244082899582243488679643187363998483750",
                    "135975176645064080784319480409372126907",
                    "6656009620071722262898265546028051753",
                    "182795118434698918247413354876311030720",
                    "116555895217447529774855995154607405320",
                    "32498471154664150952214552996299539566",
                    "14077501808074635048662467662499949871",
                    "203822638183424754996112104752538307042",
                    "243124935384298352572198521043304964238",
                    "67432646285428215482002203964939601904",
                    "284677629639334370298243113210886764123",
                    "88284404857339978816800594827858077191",
                    "212050929006309952893176550566020063688",
                    "110116365338128676460524553697840703353",
                    "229446826618053655721013982654186700996",
                    "89008197465321445437903321221028953488",
                    "84629107463580651133289858066878275048",
                    "139008816174467562375611502776526404606",
                    "296833941637323677632055537382889884681",
                    "176610308536974784043080376527110852433",
                    "138416230311545591841184864861372797191",
                    "259881131239747064783565621423245119960",
                    "62360542105451417576563909260597020875",
                    "209587067186353718523861596885105739184"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-499359964-389f729b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "190093120867025615620958954052313688392",
                "length":  894
            },
            "id":  "ASB-A-499359964-453907bb",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "copy_dmabuf_info"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "190093120867025615620958954052313688392",
                "length":  894
            },
            "id":  "ASB-A-499359964-a75e4fd1",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "copy_dmabuf_info"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "188539048586863725890419097264370020252",
                "length":  1031
            },
            "id":  "ASB-A-499359964-c003348f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "dup_dma_buf_info"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "225622031139676927674407951822210662415",
                "length":  1414
            },
            "id":  "ASB-A-499359964-d3e3f1f7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "dma_buf_begin_new_exec"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "277603533942831042957838684450805672489",
                    "131335301546573244224465578611784889497",
                    "330546395922362878290460987340422764330",
                    "186428463664412723929277109102780364377",
                    "68062566739193187382204446502280043008",
                    "72769656723554965202482409385968309962",
                    "38424048196255626444130381228031591148",
                    "304184781350158152821097057269691594965",
                    "151625118768689803590014979851687732230",
                    "331130367926654226995620745196390117994",
                    "150710803783458465005863294699009185487",
                    "340178583577228998947660012059471648381",
                    "91957248958510249059222787274901673873",
                    "281195732600067785114343108806129240130",
                    "206980953843095613535268319364595477085",
                    "326683770769006290140298279008026642876",
                    "185905442924254399759205596753210145841",
                    "245430485549501393490080528711126033729",
                    "29695344557455531578645440405051306168",
                    "58849427221100016038019995052542347919",
                    "331175882966102025993177671635638635917",
                    "118204895782943632752166350183493714065",
                    "1119602260907598637456402240494233805",
                    "190455081888449251604094195247424027135",
                    "338344862870060663960570789828293441187",
                    "306527920178083607657668765484659109600",
                    "5173922179103631259361437092914264977",
                    "102415012969978275600873468636652983860",
                    "93959454523220682406630252148637652025",
                    "321541551899181617745674301594112315511",
                    "214007207821586316672526124764442133586",
                    "294909693843627200380987820096383520284",
                    "321270013595618982131078441792431698921",
                    "282807733230106630613711509347927128668",
                    "262035659345876601404956932448352575854",
                    "98474845968899156174544017026988716600",
                    "193006981246506715978661341836466572322",
                    "283827352530074408064833119710169406835",
                    "86083725320611899670925478178621824560",
                    "166348958741955914105068745625470481723",
                    "124153149903163751390572925124905677395",
                    "40643795074385766927239435003604463576",
                    "224241419619181295386641260662036620791",
                    "95176798222403168910570895487200505537",
                    "96622909971711903870980132387947758182",
                    "143492913515266206060493034582173031417",
                    "334956775824397418502850939934351192096",
                    "303117742708575597527481657004126316670",
                    "186899200402398320261080956824820428908",
                    "144925213240813340675833297931077428876",
                    "243647154178170698011337974724886411125",
                    "174681300190455605184537775634796533392",
                    "47924997892945092873178515816875229222",
                    "231340024121044950513424136614065107421",
                    "331829799688979058998164147519664757776",
                    "36489253161055773925131862232469378208",
                    "180897225690015223618552016069118482956",
                    "307339248818513031502909675065252454208",
                    "274534675281710921837262259161157151150",
                    "257719670994824661356995096829100246865",
                    "124580340377956256297005263995460072746",
                    "266268290686737077052414475265374153452",
                    "283588449273596647362240723867181471082",
                    "175899387648126655496169631332108853816",
                    "317971906460402456071191639102307919506",
                    "336346420105769387489505430571704117680",
                    "249163552371416464398509391681322755411",
                    "127410617686265236596818649379579782386",
                    "74325177004118465905261996477067742796",
                    "257144049563657389614116879692253195475",
                    "46333189980679469885261103641684637594",
                    "24413156086886296011376641570035711374"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-499359964-d66f022f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "252275729554611972062542650401353380833",
                "length":  325
            },
            "id":  "ASB-A-499359964-ec872bd2",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79",
            "target":  {
                "file":  "drivers/dma-buf/dma-buf.c",
                "function":  "count_dmabuf_fds"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499359964.json"