In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"293465965770509000142024173560839011657"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-2c4d46ca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd",
"target": {
"file": "services/inputflinger/tests/TestEventMatchers.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"108658178601892313201041820745000251090",
"274235804638025580061230527749591457836",
"198927994915721310239442875362321671755",
"210067311850631609516033938240507198677",
"209124358096951941713543819832379930499",
"160110650091493954140683389683798380671",
"21394205853425510832680493805236588652"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-34da4581",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160826449105222200914627714970373835343",
"length": 136
},
"id": "ASB-A-514737201-350ced17",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp",
"function": "FakeInputDispatcherPolicy::notifySensorEvent"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314119858540592463643123018705034527240",
"202623295785524643058209787780001884473",
"216147547121656216317559114158733515224",
"144685521782770042263674707477242079760",
"336399690113641484067994518129552405092",
"17265028719325467244666155389713882960",
"314532636762199064024689691849925024048",
"283235338423969508401343004094362765235",
"39988035908088717764450891344825714544"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-5dc6ac2a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214745594509778223140756358184294366970",
"41389915397497767403638973597058202491",
"105109367015537534342931073142555719368",
"94123402786536386774189512547484650425",
"255370281508541751466906012072782860700",
"242030413901352065534256148474169767580",
"23147882032011429428313989758874493222",
"208592078870251651191868709757022823695",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-844a6803",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182831680416069486831457553495416202283",
"length": 490
},
"id": "ASB-A-514737201-e9538870",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/321a057cca83b8a7843b394b644ed7ab9a24cefd",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp",
"function": "InputDispatcher::flushSensor"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "179648269834086808009814697485867282154",
"length": 487
},
"id": "ASB-A-514737201-304c7360",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp",
"function": "InputDispatcher::flushSensor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314119858540592463643123018705034527240",
"202623295785524643058209787780001884473",
"216147547121656216317559114158733515224",
"325388995895576094541422586008061883897",
"185917909887853554842088070715376451532",
"326796759569898832888000614881775958074",
"243548676069597025643148606621592199877",
"47488539724964893004880681446215694144",
"329903245084611952191371780646174098252"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-4315e4d4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160826449105222200914627714970373835343",
"length": 136
},
"id": "ASB-A-514737201-9e4884f0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp",
"function": "FakeInputDispatcherPolicy::notifySensorEvent"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"175537151479139390282348740779175251061"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-b0f1b255",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662",
"target": {
"file": "services/inputflinger/tests/TestEventMatchers.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265564664560185314666144449854536108682",
"41389915397497767403638973597058202491",
"105109367015537534342931073142555719368",
"94123402786536386774189512547484650425",
"255370281508541751466906012072782860700",
"242030413901352065534256148474169767580",
"23147882032011429428313989758874493222",
"208592078870251651191868709757022823695",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-c36cbb75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"247938785923774965267643302065760073299",
"124388549356454290440227757311841980265",
"92535392711073856534331593261445384094",
"210067311850631609516033938240507198677",
"223041937097375851391079831876188768234",
"247345145669350597586570198090521527892",
"88064029040489832268880895494352213700"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-e0a8e0b5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/806489cfc8926abfd25e56d09cbb780e08a0f662",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"175537151479139390282348740779175251061"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-050c2ca6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471",
"target": {
"file": "services/inputflinger/tests/TestEventMatchers.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214745594509778223140756358184294366970",
"41389915397497767403638973597058202491",
"105109367015537534342931073142555719368",
"94123402786536386774189512547484650425",
"255370281508541751466906012072782860700",
"242030413901352065534256148474169767580",
"23147882032011429428313989758874493222",
"208592078870251651191868709757022823695",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-1721c0b5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"108658178601892313201041820745000251090",
"274235804638025580061230527749591457836",
"198927994915721310239442875362321671755",
"210067311850631609516033938240507198677",
"223041937097375851391079831876188768234",
"247345145669350597586570198090521527892",
"88064029040489832268880895494352213700"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-1a537c2e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160826449105222200914627714970373835343",
"length": 136
},
"id": "ASB-A-514737201-761e6db1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp",
"function": "FakeInputDispatcherPolicy::notifySensorEvent"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182831680416069486831457553495416202283",
"length": 490
},
"id": "ASB-A-514737201-a850ab7a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp",
"function": "InputDispatcher::flushSensor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314119858540592463643123018705034527240",
"202623295785524643058209787780001884473",
"216147547121656216317559114158733515224",
"166472332420565751227368356585331967500",
"220206512666903118481895396208005368423",
"326796759569898832888000614881775958074",
"314532636762199064024689691849925024048",
"283235338423969508401343004094362765235",
"39988035908088717764450891344825714544"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-e08b922d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8cc207f9c836c652e81d4f1a9367938f0a81a471",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.h"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"77069571010750459798892539447982689544"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-24e28c93",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5",
"target": {
"file": "services/inputflinger/tests/TestEventMatchers.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182831680416069486831457553495416202283",
"length": 490
},
"id": "ASB-A-514737201-4e9b51b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp",
"function": "InputDispatcher::flushSensor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"108658178601892313201041820745000251090",
"274235804638025580061230527749591457836",
"198927994915721310239442875362321671755",
"210067311850631609516033938240507198677",
"209124358096951941713543819832379930499",
"160110650091493954140683389683798380671",
"21394205853425510832680493805236588652"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-908ebad3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214745594509778223140756358184294366970",
"41389915397497767403638973597058202491",
"105109367015537534342931073142555719368",
"94123402786536386774189512547484650425",
"255370281508541751466906012072782860700",
"242030413901352065534256148474169767580",
"23147882032011429428313989758874493222",
"208592078870251651191868709757022823695",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-b06d8f3c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314119858540592463643123018705034527240",
"202623295785524643058209787780001884473",
"216147547121656216317559114158733515224",
"144685521782770042263674707477242079760",
"336399690113641484067994518129552405092",
"17265028719325467244666155389713882960",
"314532636762199064024689691849925024048",
"283235338423969508401343004094362765235",
"39988035908088717764450891344825714544"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-b649c804",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160826449105222200914627714970373835343",
"length": 136
},
"id": "ASB-A-514737201-bb0a7ea6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/ec322a50f181c83b58aa9428255e561baaf9e8f5",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp",
"function": "FakeInputDispatcherPolicy::notifySensorEvent"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"108658178601892313201041820745000251090",
"274235804638025580061230527749591457836",
"198927994915721310239442875362321671755",
"210067311850631609516033938240507198677",
"209124358096951941713543819832379930499",
"160110650091493954140683389683798380671",
"21394205853425510832680493805236588652"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-1f5c081e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293465965770509000142024173560839011657"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-229f13f5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5",
"target": {
"file": "services/inputflinger/tests/TestEventMatchers.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182831680416069486831457553495416202283",
"length": 490
},
"id": "ASB-A-514737201-3b3fcd1b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp",
"function": "InputDispatcher::flushSensor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160826449105222200914627714970373835343",
"length": 136
},
"id": "ASB-A-514737201-923e7449",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.cpp",
"function": "FakeInputDispatcherPolicy::notifySensorEvent"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314119858540592463643123018705034527240",
"202623295785524643058209787780001884473",
"216147547121656216317559114158733515224",
"238888896344488398318598683648666847380",
"274450872231862324733512206086693229768",
"14060939573427867731416311270389265911",
"314532636762199064024689691849925024048",
"283235338423969508401343004094362765235",
"39988035908088717764450891344825714544"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-961a1994",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5",
"target": {
"file": "services/inputflinger/tests/FakeInputDispatcherPolicy.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214745594509778223140756358184294366970",
"41389915397497767403638973597058202491",
"105109367015537534342931073142555719368",
"94123402786536386774189512547484650425",
"255370281508541751466906012072782860700",
"242030413901352065534256148474169767580",
"23147882032011429428313989758874493222",
"208592078870251651191868709757022823695",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-ebea2ed6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/8fc0f03d7de55ab2c39367ecf24c187079523dd5",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/cb0992446c7a2b19d91f642de59cb4be7d934356"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"265564664560185314666144449854536108682",
"243455765590138447318796972954279267133",
"103255146387412414915132928309192046455",
"284899915449743284648326275747588759141",
"270009428984278998809749187040575087421",
"242030413901352065534256148474169767580",
"23147882032011429428313989758874493222",
"208592078870251651191868709757022823695",
"201813785989310512801353197422550506197",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"id": "ASB-A-514737201-0e482aab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/cb0992446c7a2b19d91f642de59cb4be7d934356",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "96190110408313796266849862324860749412",
"length": 481
},
"id": "ASB-A-514737201-65b23714",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/native/+/cb0992446c7a2b19d91f642de59cb4be7d934356",
"target": {
"file": "services/inputflinger/dispatcher/InputDispatcher.cpp",
"function": "InputDispatcher::flushSensor"
}
}
]
}