{"id":"ASB-A-496996374", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58828", "A-496996374"], "details":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"121190633109205899953018928365355650915", "length":594}, "id":"ASB-A-496996374-11302d16", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/proc/base.c", "function":"proc_dmabuf_rss_hwm_write"}}, {"deprecated":false, "digest":{"line_hashes":["144936424875811636287705786150353673968", "193640744968449661777083207105905809137", "299896499794028104631689595446669035771", "272432629865637191856611218803271151597", "226390761541095895755253361876323722126", "20559885785573028659648299800603450754", "95318548099141040220293266080406827492", "43737509820338364094733693070923175191", "234009470208959458936162923735511832639", "156181208561615064087611977908795030348", "280203882091208619254828442542974097533", "278117699771744405403186539691044548754", "85237824290835710938022198621082637090", "237769578407080893830962575730478284535", "268120321645251405815550883375355122918", "167192486604112899205519650290982623893", "97046674405439118081313886115130327206", "180140536229288444871721167892889970230", "198381673266873547147269856251311294816", "268513839978389749064880895872826681835"], "threshold":0.9}, "id":"ASB-A-496996374-1ed11a49", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "target":{"file":"drivers/dma-buf/dma-buf.c"}}, {"deprecated":false, "digest":{"line_hashes":["78786539497702727321237285770681435775", "280139830888195220900443992078443695244", "17346355164411878187150541093664590268", "224020872850687490997946507700089308464"], "threshold":0.9}, "id":"ASB-A-496996374-21f247cb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "target":{"file":"fs/exec.c"}}, {"deprecated":false, "digest":{"function_hash":"248059202061468838994410823473711354318", "length":1422}, "id":"ASB-A-496996374-4861ee48", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dma_buf_begin_new_exec"}}, {"deprecated":false, "digest":{"function_hash":"189961905232342297289362512273965597249", "length":896}, "id":"ASB-A-496996374-4cc3de8c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"copy_dmabuf_info"}}, {"deprecated":false, "digest":{"function_hash":"271260972701587667592849511978718897271", "length":281}, "id":"ASB-A-496996374-5b2d9a14", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/proc/base.c", "function":"proc_dmabuf_rss_show"}}, {"deprecated":false, "digest":{"function_hash":"58540592252209991772233641989165951864", "length":2462}, "id":"ASB-A-496996374-5f8d39b7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "target":{"file":"fs/exec.c", "function":"begin_new_exec"}}, {"deprecated":false, "digest":{"line_hashes":["150897546058855192822105379004755775362", "306471992944050290386750344091053770877", "286314856623747736969668499873686025141", "67686813509375155867739506828129164153", "38791968758714814023245013737070621734", "8518798096083093472433927346636057565", "55524714265381825010954543508492964730", "182310298788695267619671647516524666990"], "threshold":0.9}, "id":"ASB-A-496996374-6e2700bf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "target":{"file":"include/linux/dma-buf.h"}}, {"deprecated":false, "digest":{"line_hashes":["131975753623824420162687009935328382818", "162137633766565095693676351096445901037", "32789971619356297414089250503443553533", "200649329229004990207066373882049795879", "298368871858772042581334382338036996444", "254574555862376300625671641626990281221", "222045387507894336046347054555806903586", "2408186557196166866561335840006688382", "131227709707329527017193425109498863248"], "threshold":0.9}, "id":"ASB-A-496996374-8af51bb9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/file.c"}}, {"deprecated":false, "digest":{"line_hashes":["144936424875811636287705786150353673968", "193640744968449661777083207105905809137", "299896499794028104631689595446669035771", "272432629865637191856611218803271151597", "226390761541095895755253361876323722126", "20559885785573028659648299800603450754", "95318548099141040220293266080406827492", "43737509820338364094733693070923175191", "234009470208959458936162923735511832639", "156181208561615064087611977908795030348", "280203882091208619254828442542974097533", "278117699771744405403186539691044548754", "85237824290835710938022198621082637090", "237769578407080893830962575730478284535", "268120321645251405815550883375355122918", "167192486604112899205519650290982623893", "97046674405439118081313886115130327206", "180140536229288444871721167892889970230", "198381673266873547147269856251311294816", "268513839978389749064880895872826681835"], "threshold":0.9}, "id":"ASB-A-496996374-94020c95", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "target":{"file":"drivers/dma-buf/dma-buf.c"}}, {"deprecated":false, "digest":{"function_hash":"136469235886032324486746894507336076993", "length":1443}, "id":"ASB-A-496996374-94e85d55", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dma_buf_begin_new_exec"}}, {"deprecated":false, "digest":{"function_hash":"189961905232342297289362512273965597249", "length":896}, "id":"ASB-A-496996374-9ba9406b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"copy_dmabuf_info"}}, {"deprecated":false, "digest":{"function_hash":"143809144763114874850666550851923264010", "length":2662}, "id":"ASB-A-496996374-9c24c8bc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "target":{"file":"fs/exec.c", "function":"begin_new_exec"}}, {"deprecated":false, "digest":{"line_hashes":["205457595181696799063232546860476232689", "103243046092815755453484235521246321604", "221767705692847563287911724819457333984", "308490989939033244539268263493676286", "326603831601775049067050821127060541334", "133743730637042434718245541132060346930", "102690074702297272000825115544846209448", "130887867609847948976152231101798961851", "147212790168001947482556077408503083417", "15895565140645480901922466084841117879", "129030590312784188693838291227564676164", "144570105669548695196431982563624401688", "320212961159511146954905964358663201192", "205073558504130261126600206343989803656", "17592154405326111016054138358863234504", "187653607181258467555659737142638140818", "75253645107116207764080428742058374419", "202890410140974152092826948666837156872", "166785272356280755627241846045533350888", "311468361170004182952629208524858680975", "155114514182380041416295704600821267226", "220516774844930688962829667144673575289", "829114396436236611439531111316975696", "63029633312844925762211410757321529092", "138841833405423142034008974247164578310", "174940105529124051924532248171946297485", "205867656050941598634302320153673469178", "196252513212567354489694540348366582483", "124894619014030146421407342864793345825", "314193527500390939716097177447025190841", "254650944108796244555409426822525270851", "248753202264697735093549444896814987420", "199719892909004446771714948613705010901", "134408722328050922849706416102781630913", "186859026706520108085868455850815054906", "183078112883946983001824338811911419035", "134508974508821255601391485548780497101", "325369267095775560093735489860683322148", "4072186091109265168197235197156565483", "240041502979313409825967993874439979852", "99495343667143400627788758879337524921", "46405056100023397418190771102364671374", "44594906358008386509241511775963084800", "76999258547185503417883516457065795147", "6711032115353364449709433140377279772", "132404261783289554030836036015584001256", "20273857640975413189028029618700603674", "309061479344305652406942526283293732267", "222281025600138647922102451156284187362", "198184730594064549605192615355663081036", "297097779157952486398537049973228635149"], "threshold":0.9}, "id":"ASB-A-496996374-b1727494", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/proc/base.c"}}, {"deprecated":false, "digest":{"function_hash":"143326892560020181287838206324621205155", "length":1431}, "id":"ASB-A-496996374-c0b8f872", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dma_buf_begin_new_exec"}}, {"deprecated":false, "digest":{"function_hash":"287285015384535246708137527890147774352", "length":419}, "id":"ASB-A-496996374-c8129159", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/proc/base.c", "function":"proc_dmabuf_rss_hwm_show"}}, {"deprecated":false, "digest":{"line_hashes":["150897546058855192822105379004755775362", "306471992944050290386750344091053770877", "286314856623747736969668499873686025141", "67686813509375155867739506828129164153", "38791968758714814023245013737070621734", "8518798096083093472433927346636057565", "55524714265381825010954543508492964730", "182310298788695267619671647516524666990"], "threshold":0.9}, "id":"ASB-A-496996374-d49ffde4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec", "target":{"file":"include/linux/dma-buf.h"}}, {"deprecated":false, "digest":{"line_hashes":["78786539497702727321237285770681435775", "280139830888195220900443992078443695244", "17346355164411878187150541093664590268", "224020872850687490997946507700089308464"], "threshold":0.9}, "id":"ASB-A-496996374-d7052050", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf", "target":{"file":"fs/exec.c"}}, {"deprecated":false, "digest":{"function_hash":"317454051753243813188455259495752872078", "length":841}, "id":"ASB-A-496996374-d810900d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/file.c", "function":"__close_range"}}, {"deprecated":false, "digest":{"function_hash":"108185142787900855411445728845277365477", "length":565}, "id":"ASB-A-496996374-ea1a1ceb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527", "target":{"file":"fs/proc/base.c", "function":"proc_dmabuf_pss_show"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471"}]}