In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc"
],
"severity": "High",
"spl": "2026-11-05",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "123653562287265820786466611231280258670",
"length": 531
},
"id": "ASB-A-533808379-12149a88",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/time/posix-cpu-timers.c",
"function": "posix_cpu_timer_del"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"43114588019524924526989266788798388833",
"228723880276375800625945384579402475220",
"175533836729769612315445994251456468189",
"14112774109510243263818320448867868721"
],
"threshold": 0.9
},
"id": "ASB-A-533808379-281260a4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/exit.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137247482359916170051141939040158303454",
"length": 355
},
"id": "ASB-A-533808379-35b142bd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/signal.c",
"function": "__lock_task_sighand"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "123653562287265820786466611231280258670",
"length": 531
},
"id": "ASB-A-533808379-70f286b0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/time/posix-cpu-timers.c",
"function": "posix_cpu_timer_del"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149941632552429856152591311313365714987",
"279388328007323953588683632076381230591",
"272856991738826480344432415864588005738",
"253125967125798295880417158431049584262",
"228621781963876772151596789014714937132"
],
"threshold": 0.9
},
"id": "ASB-A-533808379-7af73118",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/signal.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"43114588019524924526989266788798388833",
"228723880276375800625945384579402475220",
"175533836729769612315445994251456468189",
"14112774109510243263818320448867868721"
],
"threshold": 0.9
},
"id": "ASB-A-533808379-824d1fcb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/exit.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324243107520936070687765475268536307696",
"268347776245837878919206023386784763950",
"303678981118062518404972624620342862303",
"199073437246989927214916245684242630617",
"1687849992115900370266969808527387471",
"298737563853513830451560910386108234053",
"19245078002677905472440060901662239080",
"205377334666937879465523225676825578848",
"339413903058947969944737583601375195385",
"178392315473201305866504516684689401545",
"106149499730360214509305843099925179061",
"89100169802706140731633861472595977166",
"164598207134543419145712904859953124534",
"152685215247703253800513326388061087902",
"224653171555661878216588299163320144822",
"271001194193364755494294991824707129422",
"334992214003272341009983295572463271399",
"242478185876372949876066247313438326217",
"248538265346563444354989994783938161214",
"150679824179303283072829324438917752746",
"148756891936156234040708335394183838855",
"12658126624592149754324092506737527792",
"280704840908517482760122202732283784635",
"192263024971447619735405586221485486724",
"29350548663008711827056075951701964861",
"241288640051571829033499659213802901568",
"157101320479031314223853432357588203365",
"298737563853513830451560910386108234053",
"19245078002677905472440060901662239080",
"205377334666937879465523225676825578848",
"339413903058947969944737583601375195385",
"119939941493895926735414551868411148432",
"326616882032127684779829859914288072691",
"154939779382675117560091869428686626271",
"154947002456614522488157300424401648940",
"30173311800743245980225054761187882561",
"251646686894873893245611025394784268448",
"252103638247317224476503973665464308969",
"216662551416443330335700807613961228476",
"310459625445063454644132678514820963842",
"31692797687529993609347869218191569390",
"338288214296269795661465762279202277403",
"185020165765306317116351928650986195815",
"89515021375029848963354352382916143108",
"91057795080712421023482359182938543312",
"4979415748125005638418353392428608426",
"146757618273911150694287499756404433487",
"289086470073956453317619668412327282788",
"55548635884891058780738186657310634787",
"82628622357371030498986950834354750749",
"304718398240519042067171032677377216657",
"312000716194261700987173596297726867276",
"147759237623837845778794718915987797742",
"216730459540491471322891858408142801108",
"81961143379971827628611080235122972104",
"165772529597206597662868299748843562020",
"309992297679148584480319776612594467287",
"98666742321325489565332941396143999366",
"22073565362314521081855754428228627489",
"330123522891332443291055784795896640786",
"170951582768747585953691298958757905044",
"270390396800326209564243775083555401409",
"79600558126079177591989217047758316540",
"283159291610026157924141972106940564926",
"250228787412424376679471174458642956084",
"41187403167623016111532229434765079181",
"53987128708001408757438242758118719903",
"41446953492264727938848750899228081588",
"134830002413597896615237303108020320611",
"104471826456038085160752516229698115999",
"152536017818035785344726997698494032971",
"150679824179303283072829324438917752746",
"2765887644849914581356182073488238906",
"3631278316946752932570190483418331706",
"66709614813684427535314430343464648453",
"147095014628076201774578141384118571049",
"93377537123392861111467898784801096251",
"50973984736266259223614843310531861149",
"322894803993027285840830642786544189345",
"108617322520608545007248412163548998881",
"122863963647947374213999122650752011415",
"21941844526351832891815325825560766215",
"269705575031536042264572647060933496230",
"166710447985182769115863201910176491026",
"106149499730360214509305843099925179061",
"89100169802706140731633861472595977166",
"127917389040037399563073382462993140722",
"274555175857124559605474771983225507820",
"117355604941234336507230086848493947256",
"233065423273981369594785573053630429803",
"33033824758439397338906463759894198140",
"141968144502346515219785007825482827749",
"330819593899507894458845968429296150765",
"30848131153742286084401562982421929426",
"308564604525847688672797322506773564218",
"43450817236585217659631878009222617028"
],
"threshold": 0.9
},
"id": "ASB-A-533808379-8f832758",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137247482359916170051141939040158303454",
"length": 355
},
"id": "ASB-A-533808379-b1f91057",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/signal.c",
"function": "__lock_task_sighand"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324243107520936070687765475268536307696",
"268347776245837878919206023386784763950",
"303678981118062518404972624620342862303",
"199073437246989927214916245684242630617",
"1687849992115900370266969808527387471",
"298737563853513830451560910386108234053",
"19245078002677905472440060901662239080",
"205377334666937879465523225676825578848",
"339413903058947969944737583601375195385",
"178392315473201305866504516684689401545",
"106149499730360214509305843099925179061",
"89100169802706140731633861472595977166",
"164598207134543419145712904859953124534",
"152685215247703253800513326388061087902",
"224653171555661878216588299163320144822",
"271001194193364755494294991824707129422",
"334992214003272341009983295572463271399",
"242478185876372949876066247313438326217",
"248538265346563444354989994783938161214",
"150679824179303283072829324438917752746",
"148756891936156234040708335394183838855",
"12658126624592149754324092506737527792",
"280704840908517482760122202732283784635",
"192263024971447619735405586221485486724",
"29350548663008711827056075951701964861",
"156525215759013689317128499691611151178",
"216749289074039913082979358020014375529",
"252171431420801449694938499899194725054",
"19245078002677905472440060901662239080",
"205377334666937879465523225676825578848",
"339413903058947969944737583601375195385",
"119939941493895926735414551868411148432",
"326616882032127684779829859914288072691",
"154939779382675117560091869428686626271",
"154947002456614522488157300424401648940",
"30173311800743245980225054761187882561",
"251646686894873893245611025394784268448",
"252103638247317224476503973665464308969",
"216662551416443330335700807613961228476",
"310459625445063454644132678514820963842",
"31692797687529993609347869218191569390",
"160235025493294788274410399779854591978",
"103524996572791825911924027063019655488",
"8930130676006828483559122377766831952",
"55548635884891058780738186657310634787",
"82628622357371030498986950834354750749",
"221851050294052885345319879717283308929",
"235218780496809334130815441857952397297",
"19577288630110716668797227003816795355",
"289730302734461431177569180921036387321",
"231347635987885555335154039414287844291",
"177248875989916298676270152345390005624",
"196015176377735789602224040673685962111",
"322894803993027285840830642786544189345",
"108617322520608545007248412163548998881",
"122863963647947374213999122650752011415",
"21941844526351832891815325825560766215",
"269705575031536042264572647060933496230",
"166710447985182769115863201910176491026",
"106149499730360214509305843099925179061",
"89100169802706140731633861472595977166",
"127917389040037399563073382462993140722",
"274555175857124559605474771983225507820",
"117355604941234336507230086848493947256",
"233065423273981369594785573053630429803",
"33033824758439397338906463759894198140",
"141968144502346515219785007825482827749",
"330819593899507894458845968429296150765",
"30848131153742286084401562982421929426",
"308564604525847688672797322506773564218",
"43450817236585217659631878009222617028"
],
"threshold": 0.9
},
"id": "ASB-A-533808379-d1959f80",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262239292286114736391504406723550354151",
"length": 505
},
"id": "ASB-A-533808379-d280b0dc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/time/posix-cpu-timers.c",
"function": "posix_cpu_timer_rearm"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20949003356167785927485037916243630608",
"length": 1435
},
"id": "ASB-A-533808379-d5f759c0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/exit.c",
"function": "__exit_signal"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262239292286114736391504406723550354151",
"length": 505
},
"id": "ASB-A-533808379-dce4563a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/time/posix-cpu-timers.c",
"function": "posix_cpu_timer_rearm"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20949003356167785927485037916243630608",
"length": 1435
},
"id": "ASB-A-533808379-f21d1bda",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc",
"target": {
"file": "kernel/exit.c",
"function": "__exit_signal"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149941632552429856152591311313365714987",
"279388328007323953588683632076381230591",
"272856991738826480344432415864588005738",
"253125967125798295880417158431049584262",
"228621781963876772151596789014714937132"
],
"threshold": 0.9
},
"id": "ASB-A-533808379-fd648de4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4",
"target": {
"file": "kernel/signal.c"
}
}
]
}