{"id":"ASB-A-499359964", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58827", "A-499359964"], "details":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67", "https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"110119949003007147025732269034498067476", "length":1405}, "id":"ASB-A-499359964-098af70a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dma_buf_begin_new_exec"}}, {"deprecated":false, "digest":{"function_hash":"188539048586863725890419097264370020252", "length":1031}, "id":"ASB-A-499359964-2ab600bd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dup_dma_buf_info"}}, {"deprecated":false, "digest":{"line_hashes":["277603533942831042957838684450805672489", "131335301546573244224465578611784889497", "330546395922362878290460987340422764330", "186428463664412723929277109102780364377", "68062566739193187382204446502280043008", "72769656723554965202482409385968309962", "38424048196255626444130381228031591148", "304184781350158152821097057269691594965", "151625118768689803590014979851687732230", "331130367926654226995620745196390117994", "150710803783458465005863294699009185487", "340178583577228998947660012059471648381", "91957248958510249059222787274901673873", "281195732600067785114343108806129240130", "206980953843095613535268319364595477085", "326683770769006290140298279008026642876", "185905442924254399759205596753210145841", "245430485549501393490080528711126033729", "29695344557455531578645440405051306168", "58849427221100016038019995052542347919", "331175882966102025993177671635638635917", "118204895782943632752166350183493714065", "1119602260907598637456402240494233805", "190455081888449251604094195247424027135", "338344862870060663960570789828293441187", "306527920178083607657668765484659109600", "5173922179103631259361437092914264977", "102415012969978275600873468636652983860", "93959454523220682406630252148637652025", "321541551899181617745674301594112315511", "214007207821586316672526124764442133586", "294909693843627200380987820096383520284", "321270013595618982131078441792431698921", "282807733230106630613711509347927128668", "262035659345876601404956932448352575854", "98474845968899156174544017026988716600", "193006981246506715978661341836466572322", "283827352530074408064833119710169406835", "86083725320611899670925478178621824560", "166348958741955914105068745625470481723", "124153149903163751390572925124905677395", "40643795074385766927239435003604463576", "224241419619181295386641260662036620791", "95176798222403168910570895487200505537", "96622909971711903870980132387947758182", "143492913515266206060493034582173031417", "334956775824397418502850939934351192096", "303117742708575597527481657004126316670", "186899200402398320261080956824820428908", "144925213240813340675833297931077428876", "243647154178170698011337974724886411125", "174681300190455605184537775634796533392", "244082899582243488679643187363998483750", "135975176645064080784319480409372126907", "6656009620071722262898265546028051753", "182795118434698918247413354876311030720", "116555895217447529774855995154607405320", "32498471154664150952214552996299539566", "14077501808074635048662467662499949871", "203822638183424754996112104752538307042", "243124935384298352572198521043304964238", "67432646285428215482002203964939601904", "284677629639334370298243113210886764123", "88284404857339978816800594827858077191", "212050929006309952893176550566020063688", "110116365338128676460524553697840703353", "229446826618053655721013982654186700996", "89008197465321445437903321221028953488", "84629107463580651133289858066878275048", "139008816174467562375611502776526404606", "296833941637323677632055537382889884681", "176610308536974784043080376527110852433", "138416230311545591841184864861372797191", "259881131239747064783565621423245119960", "62360542105451417576563909260597020875", "209587067186353718523861596885105739184"], "threshold":0.9}, "id":"ASB-A-499359964-389f729b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79", "target":{"file":"drivers/dma-buf/dma-buf.c"}}, {"deprecated":false, "digest":{"function_hash":"190093120867025615620958954052313688392", "length":894}, "id":"ASB-A-499359964-453907bb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"copy_dmabuf_info"}}, {"deprecated":false, "digest":{"function_hash":"190093120867025615620958954052313688392", "length":894}, "id":"ASB-A-499359964-a75e4fd1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"copy_dmabuf_info"}}, {"deprecated":false, "digest":{"function_hash":"188539048586863725890419097264370020252", "length":1031}, "id":"ASB-A-499359964-c003348f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dup_dma_buf_info"}}, {"deprecated":false, "digest":{"function_hash":"225622031139676927674407951822210662415", "length":1414}, "id":"ASB-A-499359964-d3e3f1f7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"dma_buf_begin_new_exec"}}, {"deprecated":false, "digest":{"line_hashes":["277603533942831042957838684450805672489", "131335301546573244224465578611784889497", "330546395922362878290460987340422764330", "186428463664412723929277109102780364377", "68062566739193187382204446502280043008", "72769656723554965202482409385968309962", "38424048196255626444130381228031591148", "304184781350158152821097057269691594965", "151625118768689803590014979851687732230", "331130367926654226995620745196390117994", "150710803783458465005863294699009185487", "340178583577228998947660012059471648381", "91957248958510249059222787274901673873", "281195732600067785114343108806129240130", "206980953843095613535268319364595477085", "326683770769006290140298279008026642876", "185905442924254399759205596753210145841", "245430485549501393490080528711126033729", "29695344557455531578645440405051306168", "58849427221100016038019995052542347919", "331175882966102025993177671635638635917", "118204895782943632752166350183493714065", "1119602260907598637456402240494233805", "190455081888449251604094195247424027135", "338344862870060663960570789828293441187", "306527920178083607657668765484659109600", "5173922179103631259361437092914264977", "102415012969978275600873468636652983860", "93959454523220682406630252148637652025", "321541551899181617745674301594112315511", "214007207821586316672526124764442133586", "294909693843627200380987820096383520284", "321270013595618982131078441792431698921", "282807733230106630613711509347927128668", "262035659345876601404956932448352575854", "98474845968899156174544017026988716600", "193006981246506715978661341836466572322", "283827352530074408064833119710169406835", "86083725320611899670925478178621824560", "166348958741955914105068745625470481723", "124153149903163751390572925124905677395", "40643795074385766927239435003604463576", "224241419619181295386641260662036620791", "95176798222403168910570895487200505537", "96622909971711903870980132387947758182", "143492913515266206060493034582173031417", "334956775824397418502850939934351192096", "303117742708575597527481657004126316670", "186899200402398320261080956824820428908", "144925213240813340675833297931077428876", "243647154178170698011337974724886411125", "174681300190455605184537775634796533392", "47924997892945092873178515816875229222", "231340024121044950513424136614065107421", "331829799688979058998164147519664757776", "36489253161055773925131862232469378208", "180897225690015223618552016069118482956", "307339248818513031502909675065252454208", "274534675281710921837262259161157151150", "257719670994824661356995096829100246865", "124580340377956256297005263995460072746", "266268290686737077052414475265374153452", "283588449273596647362240723867181471082", "175899387648126655496169631332108853816", "317971906460402456071191639102307919506", "336346420105769387489505430571704117680", "249163552371416464398509391681322755411", "127410617686265236596818649379579782386", "74325177004118465905261996477067742796", "257144049563657389614116879692253195475", "46333189980679469885261103641684637594", "24413156086886296011376641570035711374"], "threshold":0.9}, "id":"ASB-A-499359964-d66f022f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67", "target":{"file":"drivers/dma-buf/dma-buf.c"}}, {"deprecated":false, "digest":{"function_hash":"252275729554611972062542650401353380833", "length":325}, "id":"ASB-A-499359964-ec872bd2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79", "target":{"file":"drivers/dma-buf/dma-buf.c", "function":"count_dmabuf_fds"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"}]}