{"id":"ASB-A-508702285", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-03T17:44:55.642301420Z", "aliases":["CVE-2026-53256", "A-508702285"], "details":"In multiple functions of sock.c, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b", "https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083"], "severity":"Critical", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["119304148606108425620440520749268973760", "114456420057588136829214563551446071301", "109753092265637300733483360952299793114", "239857816977802249055733047565454650742", "39515061866892379177069211544348755438", "114100749486237938371200905835892104867", "81535646171803311523337324628721926936", "114550349818490728001999322351770717428", "335632952412772202576072628092425987094", "299693517246550718062294192466148883943", "25345098154643556846009525995537098514", "328875349520424167271909868170753176862", "318218412031819257420271960532560371785", "194513113760957078398125523911873778353", "187548019280731213540436955772254212271", "284128772810276791188601080636789077216", "209804058756067137627904593084442880692", "208798607309109665307419088567308909111", "249762910882865787570726701501775891717", "185712190580179842891860486597205289511", "76071929915527304249894607992807628611", "198866531542447259379823044310549319919", "21421823350857257870372944673665977128", "305764427721473629964608808453175536908"], "threshold":0.9}, "id":"ASB-A-508702285-0d96e578", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b", "target":{"file":"net/bluetooth/rfcomm/sock.c"}}, {"deprecated":false, "digest":{"function_hash":"58419060613801774781814851664564955719", "length":501}, "id":"ASB-A-508702285-4e22975b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083", "target":{"file":"net/bluetooth/rfcomm/sock.c", "function":"rfcomm_get_sock_by_channel"}}, {"deprecated":false, "digest":{"function_hash":"6242110563616028922857955664654898619", "length":950}, "id":"ASB-A-508702285-c61a75bc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b", "target":{"file":"net/bluetooth/rfcomm/sock.c", "function":"rfcomm_connect_ind"}}, {"deprecated":false, "digest":{"line_hashes":["119304148606108425620440520749268973760", "114456420057588136829214563551446071301", "109753092265637300733483360952299793114", "239857816977802249055733047565454650742", "39515061866892379177069211544348755438", "114100749486237938371200905835892104867", "81535646171803311523337324628721926936", "114550349818490728001999322351770717428", "335632952412772202576072628092425987094", "299693517246550718062294192466148883943", "25345098154643556846009525995537098514", "328875349520424167271909868170753176862", "318218412031819257420271960532560371785", "194513113760957078398125523911873778353", "187548019280731213540436955772254212271", "284128772810276791188601080636789077216", "209804058756067137627904593084442880692", "208798607309109665307419088567308909111", "249762910882865787570726701501775891717", "185712190580179842891860486597205289511", "76071929915527304249894607992807628611", "198866531542447259379823044310549319919", "21421823350857257870372944673665977128", "305764427721473629964608808453175536908"], "threshold":0.9}, "id":"ASB-A-508702285-cc480566", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083", "target":{"file":"net/bluetooth/rfcomm/sock.c"}}, {"deprecated":false, "digest":{"function_hash":"6242110563616028922857955664654898619", "length":950}, "id":"ASB-A-508702285-e0614e82", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083", "target":{"file":"net/bluetooth/rfcomm/sock.c", "function":"rfcomm_connect_ind"}}, {"deprecated":false, "digest":{"function_hash":"58419060613801774781814851664564955719", "length":501}, "id":"ASB-A-508702285-fc90bc7f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b", "target":{"file":"net/bluetooth/rfcomm/sock.c", "function":"rfcomm_get_sock_by_channel"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083"}]}