ASB-A-508702285

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-508702285.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-508702285
Aliases
Published
2026-11-01T00:00:00Z
Modified
2026-11-03T17:44:55Z
Summary
[none]
Details

In multiple functions of sock.c, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b",
        "https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083"
    ],
    "severity": "Critical",
    "spl": "2026-11-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "119304148606108425620440520749268973760",
                    "114456420057588136829214563551446071301",
                    "109753092265637300733483360952299793114",
                    "239857816977802249055733047565454650742",
                    "39515061866892379177069211544348755438",
                    "114100749486237938371200905835892104867",
                    "81535646171803311523337324628721926936",
                    "114550349818490728001999322351770717428",
                    "335632952412772202576072628092425987094",
                    "299693517246550718062294192466148883943",
                    "25345098154643556846009525995537098514",
                    "328875349520424167271909868170753176862",
                    "318218412031819257420271960532560371785",
                    "194513113760957078398125523911873778353",
                    "187548019280731213540436955772254212271",
                    "284128772810276791188601080636789077216",
                    "209804058756067137627904593084442880692",
                    "208798607309109665307419088567308909111",
                    "249762910882865787570726701501775891717",
                    "185712190580179842891860486597205289511",
                    "76071929915527304249894607992807628611",
                    "198866531542447259379823044310549319919",
                    "21421823350857257870372944673665977128",
                    "305764427721473629964608808453175536908"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508702285-0d96e578",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b",
            "target": {
                "file": "net/bluetooth/rfcomm/sock.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "58419060613801774781814851664564955719",
                "length": 501
            },
            "id": "ASB-A-508702285-4e22975b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083",
            "target": {
                "file": "net/bluetooth/rfcomm/sock.c",
                "function": "rfcomm_get_sock_by_channel"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "6242110563616028922857955664654898619",
                "length": 950
            },
            "id": "ASB-A-508702285-c61a75bc",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b",
            "target": {
                "file": "net/bluetooth/rfcomm/sock.c",
                "function": "rfcomm_connect_ind"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "119304148606108425620440520749268973760",
                    "114456420057588136829214563551446071301",
                    "109753092265637300733483360952299793114",
                    "239857816977802249055733047565454650742",
                    "39515061866892379177069211544348755438",
                    "114100749486237938371200905835892104867",
                    "81535646171803311523337324628721926936",
                    "114550349818490728001999322351770717428",
                    "335632952412772202576072628092425987094",
                    "299693517246550718062294192466148883943",
                    "25345098154643556846009525995537098514",
                    "328875349520424167271909868170753176862",
                    "318218412031819257420271960532560371785",
                    "194513113760957078398125523911873778353",
                    "187548019280731213540436955772254212271",
                    "284128772810276791188601080636789077216",
                    "209804058756067137627904593084442880692",
                    "208798607309109665307419088567308909111",
                    "249762910882865787570726701501775891717",
                    "185712190580179842891860486597205289511",
                    "76071929915527304249894607992807628611",
                    "198866531542447259379823044310549319919",
                    "21421823350857257870372944673665977128",
                    "305764427721473629964608808453175536908"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508702285-cc480566",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083",
            "target": {
                "file": "net/bluetooth/rfcomm/sock.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "6242110563616028922857955664654898619",
                "length": 950
            },
            "id": "ASB-A-508702285-e0614e82",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083",
            "target": {
                "file": "net/bluetooth/rfcomm/sock.c",
                "function": "rfcomm_connect_ind"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "58419060613801774781814851664564955719",
                "length": 501
            },
            "id": "ASB-A-508702285-fc90bc7f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b",
            "target": {
                "file": "net/bluetooth/rfcomm/sock.c",
                "function": "rfcomm_get_sock_by_channel"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-508702285.json"