{"id":"ASB-A-500022799", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-52993", "A-500022799"], "details":"In tipc_buf_append of msg.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-09-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c", "https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d"], "severity":"Critical", "spl":"2026-09-05", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"174027384355739275013206633683574555107", "length":1261}, "id":"ASB-A-500022799-507459db", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c", "target":{"file":"net/tipc/msg.c", "function":"tipc_buf_append"}}, {"deprecated":false, "digest":{"line_hashes":["97423760747217642517742387495835668389", "14278505440988646182880112207177411372", "106901716513671116461506560072627084916", "100336213267718126617818844093329217311", "29235504496700833827974129505928782930"], "threshold":0.9}, "id":"ASB-A-500022799-53b63d18", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c", "target":{"file":"net/tipc/msg.c"}}, {"deprecated":false, "digest":{"line_hashes":["97423760747217642517742387495835668389", "14278505440988646182880112207177411372", "106901716513671116461506560072627084916", "100336213267718126617818844093329217311", "29235504496700833827974129505928782930"], "threshold":0.9}, "id":"ASB-A-500022799-a6710fdc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d", "target":{"file":"net/tipc/msg.c"}}, {"deprecated":false, "digest":{"function_hash":"174027384355739275013206633683574555107", "length":1261}, "id":"ASB-A-500022799-eb3e7c6b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d", "target":{"file":"net/tipc/msg.c", "function":"tipc_buf_append"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d"}]}