ASB-A-499361237

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-499361237.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-499361237
Aliases
  • A-499361237
  • CVE-2026-58825
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:24Z
Summary
[none]
Details

In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4",
        "https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555"
    ],
    "severity":  "High",
    "spl":  "2026-11-05",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "31936906226223388559417505331229953252",
                "length":  1623
            },
            "id":  "ASB-A-499361237-25b0498e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4",
            "target":  {
                "file":  "kernel/fork.c",
                "function":  "ksys_unshare"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "31936906226223388559417505331229953252",
                "length":  1623
            },
            "id":  "ASB-A-499361237-266f5cb5",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555",
            "target":  {
                "file":  "kernel/fork.c",
                "function":  "ksys_unshare"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "90626034782223937776344355026251456313",
                "length":  339
            },
            "id":  "ASB-A-499361237-4afe1c41",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4",
            "target":  {
                "file":  "kernel/fork.c",
                "function":  "unshare_files"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "36068004602098560576594699183806772271",
                    "316419745042241145310504515138626807881",
                    "100954991621458826644375534037386094047",
                    "46337904111734924205258547885548600621",
                    "175929497002181099523772028967212025801",
                    "52374567015430585028108369470043628376",
                    "305256934718450275009964286259335414416",
                    "5558400927124673955651212891260072071",
                    "136347096054282790423764663137901663334",
                    "197837629402375992007431637035318602768",
                    "217602315266044471657097891911591037663",
                    "302763030707065359873618064654383779343",
                    "128211658509124824326653110876134760903",
                    "92713346458958093106007064821078121218",
                    "121142000825365544902605149996497899355",
                    "176249126497731351457524210261102813352",
                    "325693500623688951029903857434003192059",
                    "32985780935236629985737385441043322827",
                    "82161613025239288555498243203183849198",
                    "292097578203805099167132776224033645875"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-499361237-cfe87e21",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555",
            "target":  {
                "file":  "kernel/fork.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "90626034782223937776344355026251456313",
                "length":  339
            },
            "id":  "ASB-A-499361237-d4c4c6ea",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555",
            "target":  {
                "file":  "kernel/fork.c",
                "function":  "unshare_files"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "36068004602098560576594699183806772271",
                    "316419745042241145310504515138626807881",
                    "100954991621458826644375534037386094047",
                    "46337904111734924205258547885548600621",
                    "175929497002181099523772028967212025801",
                    "52374567015430585028108369470043628376",
                    "305256934718450275009964286259335414416",
                    "5558400927124673955651212891260072071",
                    "136347096054282790423764663137901663334",
                    "197837629402375992007431637035318602768",
                    "217602315266044471657097891911591037663",
                    "302763030707065359873618064654383779343",
                    "128211658509124824326653110876134760903",
                    "92713346458958093106007064821078121218",
                    "121142000825365544902605149996497899355",
                    "176249126497731351457524210261102813352",
                    "325693500623688951029903857434003192059",
                    "32985780935236629985737385441043322827",
                    "82161613025239288555498243203183849198",
                    "292097578203805099167132776224033645875"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-499361237-f5b99c8c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4",
            "target":  {
                "file":  "kernel/fork.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499361237.json"