{"id":"ASB-A-499361237", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58825", "A-499361237"], "details":"In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4", "https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"31936906226223388559417505331229953252", "length":1623}, "id":"ASB-A-499361237-25b0498e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4", "target":{"file":"kernel/fork.c", "function":"ksys_unshare"}}, {"deprecated":false, "digest":{"function_hash":"31936906226223388559417505331229953252", "length":1623}, "id":"ASB-A-499361237-266f5cb5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555", "target":{"file":"kernel/fork.c", "function":"ksys_unshare"}}, {"deprecated":false, "digest":{"function_hash":"90626034782223937776344355026251456313", "length":339}, "id":"ASB-A-499361237-4afe1c41", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4", "target":{"file":"kernel/fork.c", "function":"unshare_files"}}, {"deprecated":false, "digest":{"line_hashes":["36068004602098560576594699183806772271", "316419745042241145310504515138626807881", "100954991621458826644375534037386094047", "46337904111734924205258547885548600621", "175929497002181099523772028967212025801", "52374567015430585028108369470043628376", "305256934718450275009964286259335414416", "5558400927124673955651212891260072071", "136347096054282790423764663137901663334", "197837629402375992007431637035318602768", "217602315266044471657097891911591037663", "302763030707065359873618064654383779343", "128211658509124824326653110876134760903", "92713346458958093106007064821078121218", "121142000825365544902605149996497899355", "176249126497731351457524210261102813352", "325693500623688951029903857434003192059", "32985780935236629985737385441043322827", "82161613025239288555498243203183849198", "292097578203805099167132776224033645875"], "threshold":0.9}, "id":"ASB-A-499361237-cfe87e21", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555", "target":{"file":"kernel/fork.c"}}, {"deprecated":false, "digest":{"function_hash":"90626034782223937776344355026251456313", "length":339}, "id":"ASB-A-499361237-d4c4c6ea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555", "target":{"file":"kernel/fork.c", "function":"unshare_files"}}, {"deprecated":false, "digest":{"line_hashes":["36068004602098560576594699183806772271", "316419745042241145310504515138626807881", "100954991621458826644375534037386094047", "46337904111734924205258547885548600621", "175929497002181099523772028967212025801", "52374567015430585028108369470043628376", "305256934718450275009964286259335414416", "5558400927124673955651212891260072071", "136347096054282790423764663137901663334", "197837629402375992007431637035318602768", "217602315266044471657097891911591037663", "302763030707065359873618064654383779343", "128211658509124824326653110876134760903", "92713346458958093106007064821078121218", "121142000825365544902605149996497899355", "176249126497731351457524210261102813352", "325693500623688951029903857434003192059", "32985780935236629985737385441043322827", "82161613025239288555498243203183849198", "292097578203805099167132776224033645875"], "threshold":0.9}, "id":"ASB-A-499361237-f5b99c8c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4", "target":{"file":"kernel/fork.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555"}]}