ASB-A-510777270

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-510777270.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-510777270
Aliases
Published
2026-11-01T00:00:00Z
Modified
2026-11-06T16:30:33Z
Summary
[none]
Details

In multiple locations, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
        "https://android.googlesource.com/kernel/common/+/32b16e61d1a02c4554d48b544ea4739d12e450e7",
        "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
        "https://android.googlesource.com/kernel/common/+/055c84c410288cf5169e180f8aca0792b6b8c9de"
    ],
    "severity": "High",
    "spl": "2026-11-05",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "91742733428788130397965204293108171244",
                "length": 2158
            },
            "id": "ASB-A-510777270-06f2fbc9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/skbuff.c",
                "function": "skb_shift"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "319856442849024638003504312862304246647",
                "length": 5964
            },
            "id": "ASB-A-510777270-0c863b6a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/skbuff.c",
                "function": "skb_segment"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280867113296349441708551663015315042137",
                "length": 1042
            },
            "id": "ASB-A-510777270-0dcf6d63",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/skbuff.c",
                "function": "__pskb_copy_fclone"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280867113296349441708551663015315042137",
                "length": 1042
            },
            "id": "ASB-A-510777270-147f007b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/core/skbuff.c",
                "function": "__pskb_copy_fclone"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "312881643177826280777830297044347504768",
                    "297846943928482041375948823317799282383",
                    "285743020579598522495409899793644455257",
                    "90538739864380090038366245362115199228",
                    "324360749300625992716500536097904881082",
                    "190416525755408548172885947640085701606",
                    "338350720209766154941851486207549619534",
                    "218426955400649711511664834721023917489",
                    "160932596683480856539897854816098598170",
                    "339536572689343542328215863006768141239",
                    "152536960485818613522586827230375834995",
                    "199634962422568380063236981001517002603",
                    "8382474956000402941024382491797402559",
                    "322684015240767507523435753370583460076",
                    "336777174111468257512648731284958139213"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-510777270-1f118712",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/skbuff.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "312881643177826280777830297044347504768",
                    "297846943928482041375948823317799282383",
                    "285743020579598522495409899793644455257",
                    "90538739864380090038366245362115199228",
                    "324360749300625992716500536097904881082",
                    "190416525755408548172885947640085701606",
                    "338350720209766154941851486207549619534",
                    "218426955400649711511664834721023917489",
                    "160932596683480856539897854816098598170",
                    "339536572689343542328215863006768141239",
                    "152536960485818613522586827230375834995",
                    "199634962422568380063236981001517002603",
                    "8382474956000402941024382491797402559",
                    "322684015240767507523435753370583460076",
                    "336777174111468257512648731284958139213"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-510777270-22bbff85",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/core/skbuff.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "284551892310142972892462443899426368952",
                    "107230980890878505977582831301549243582",
                    "332930435860706616423229368963062467612",
                    "81177134186905337338397903792156864869"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-510777270-2965f2c9",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/ipv4/tcp_output.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "290437696452964944089008959090018522447",
                "length": 580
            },
            "id": "ASB-A-510777270-4885d06a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/gro.c",
                "function": "skb_gro_receive_list"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "243613004856564571972376881901091222768",
                "length": 2802
            },
            "id": "ASB-A-510777270-51144b47",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/gro.c",
                "function": "skb_gro_receive"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "285931845256607974888125062127953898479",
                "length": 5965
            },
            "id": "ASB-A-510777270-56047f4a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/core/skbuff.c",
                "function": "skb_segment"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "243613004856564571972376881901091222768",
                "length": 2802
            },
            "id": "ASB-A-510777270-6efbfdd3",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/core/gro.c",
                "function": "skb_gro_receive"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "227739965523775833213645733882847545764",
                "length": 2067
            },
            "id": "ASB-A-510777270-8682ccba",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/core/skbuff.c",
                "function": "skb_shift"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "56185576558040875368284456804077943380",
                    "318782309485420706209309296235445509879",
                    "227611995469135165587549726479859741839",
                    "73080700397866984672625131147371022088",
                    "247709252813333293106021914147493333691",
                    "100933641374056081934403260978026728600",
                    "147155615285117421597739311656427839954",
                    "97420916760095354680843254574730468679",
                    "227952949834520182169332113779308920045",
                    "283566494111398482778146177706738809207",
                    "75387441328425519908524765887164045313"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-510777270-8a1ab4ff",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/core/gro.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "45472403817046738367471062135241862215",
                "length": 1142
            },
            "id": "ASB-A-510777270-91a3ec48",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/ipv4/tcp_output.c",
                "function": "tcp_clone_payload"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "284551892310142972892462443899426368952",
                    "107230980890878505977582831301549243582",
                    "332930435860706616423229368963062467612",
                    "81177134186905337338397903792156864869"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-510777270-ceb96dad",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/ipv4/tcp_output.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "45472403817046738367471062135241862215",
                "length": 1142
            },
            "id": "ASB-A-510777270-e53cc8eb",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1",
            "target": {
                "file": "net/ipv4/tcp_output.c",
                "function": "tcp_clone_payload"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "56185576558040875368284456804077943380",
                    "318782309485420706209309296235445509879",
                    "227611995469135165587549726479859741839",
                    "73080700397866984672625131147371022088",
                    "247709252813333293106021914147493333691",
                    "100933641374056081934403260978026728600",
                    "147155615285117421597739311656427839954",
                    "97420916760095354680843254574730468679",
                    "124729368298976677326944785488206199926",
                    "54147940626994910768661334849157025106",
                    "39379825384269018709475356749774132187",
                    "158061157999566435289656919733204680211"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-510777270-f151f101",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d",
            "target": {
                "file": "net/core/gro.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-510777270.json"