ASB-A-508702364

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-508702364.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-508702364

Aliases

A-508702364
CVE-2026-89774

Published

2026-11-01T00:00:00Z

Modified

2026-11-03T17:44:55Z

Summary

[none]

Details

In multiple functions of sco.c, there is a possible use-after-free due to a race condition. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name: :linux_kernel:

Affected ranges

Type: ECOSYSTEM
Events: Introduced

:0

Fixed

:2026-11-05

Affected versions

Other

Kernel

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/315636ba7cbf03382cfa7bd8887118f59fe96c5f",
        "https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb",
        "https://android.googlesource.com/kernel/common/+/84728e305ff666fc2bf2be382b422b51912d7b1c",
        "https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a"
    ],
    "severity": "Critical",
    "spl": "2026-11-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "273364551645338130697825508727241130297",
                    "275908178875978117776352226865614959846",
                    "293763659914679669206540731570329294576",
                    "157976387003120787858427734019012359638",
                    "16923051719742114461656602309514615766",
                    "139491148476820057207780320113663748263",
                    "290464195320875838348115235392778370203",
                    "210330632548212883944608933081380284154",
                    "149738300467627174037688796449593648879",
                    "163860092760068168527973404496330574299",
                    "117652904510319141525138768182563033961",
                    "311573751295308132078103560150549670592",
                    "90782519114656288674661256744102693445",
                    "230744974639091283630199179283443179404",
                    "1758954352448707785300830385368890571",
                    "257378971991063428663598234511197412995",
                    "255842230632903779588210061712097146888",
                    "96487420358020009315788618222781474038",
                    "71623675858635082092189388405736378796",
                    "295223522198145799127549827488787723513",
                    "67417721803691219438397107276495800094",
                    "256145075084012526286231653295815039809",
                    "245609480039668376167631402016154579609",
                    "46314266466018278230280954785230977585"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508702364-1edeb818",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a",
            "target": {
                "file": "net/bluetooth/sco.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "98532195768334665285801633892327255544",
                "length": 1024
            },
            "id": "ASB-A-508702364-c8f953a5",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb",
            "target": {
                "file": "net/bluetooth/sco.c",
                "function": "sco_conn_ready"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "98532195768334665285801633892327255544",
                "length": 1024
            },
            "id": "ASB-A-508702364-d9ff4b43",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a",
            "target": {
                "file": "net/bluetooth/sco.c",
                "function": "sco_conn_ready"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "273364551645338130697825508727241130297",
                    "275908178875978117776352226865614959846",
                    "293763659914679669206540731570329294576",
                    "157976387003120787858427734019012359638",
                    "16923051719742114461656602309514615766",
                    "139491148476820057207780320113663748263",
                    "290464195320875838348115235392778370203",
                    "210330632548212883944608933081380284154",
                    "149738300467627174037688796449593648879",
                    "163860092760068168527973404496330574299",
                    "117652904510319141525138768182563033961",
                    "311573751295308132078103560150549670592",
                    "90782519114656288674661256744102693445",
                    "230744974639091283630199179283443179404",
                    "1758954352448707785300830385368890571",
                    "257378971991063428663598234511197412995",
                    "255842230632903779588210061712097146888",
                    "96487420358020009315788618222781474038",
                    "71623675858635082092189388405736378796",
                    "295223522198145799127549827488787723513",
                    "67417721803691219438397107276495800094",
                    "256145075084012526286231653295815039809",
                    "245609480039668376167631402016154579609",
                    "46314266466018278230280954785230977585"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-508702364-e29745be",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb",
            "target": {
                "file": "net/bluetooth/sco.c"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-508702364.json"