{"id":"ASB-A-511263142", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58990", "A-511263142"], "details":"In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c2a47d8f70ef96e417ac0aec02a80c5ec5710e3a"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"278481947417331680563942531163900918557", "length":2676}, "id":"ASB-A-511263142-d9c2644a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c2a47d8f70ef96e417ac0aec02a80c5ec5710e3a", "target":{"file":"system/stack/l2cap/l2c_fcr.cc", "function":"l2c_fcr_process_peer_cfg_req"}}, {"deprecated":false, "digest":{"line_hashes":["168556504593283868926714992799695355084", "6600388060011762667856770947447871709", "286451409060989210914113686422403817087"], "threshold":0.9}, "id":"ASB-A-511263142-e3c45946", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c2a47d8f70ef96e417ac0aec02a80c5ec5710e3a", "target":{"file":"system/stack/l2cap/l2c_fcr.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c9103006b383b9e6be353c54f2948b6989400d3"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["159398918011162506279187512366821457941", "337394940854092034711896107288549428702", "266855468169604221462535693855786658067"], "threshold":0.9}, "id":"ASB-A-511263142-0dcf8cab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c9103006b383b9e6be353c54f2948b6989400d3", "target":{"file":"system/stack/l2cap/l2c_fcr.cc"}}, {"deprecated":false, "digest":{"function_hash":"137296520204503045751365786225763141905", "length":2486}, "id":"ASB-A-511263142-6957218b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c9103006b383b9e6be353c54f2948b6989400d3", "target":{"file":"system/stack/l2cap/l2c_fcr.cc", "function":"l2c_fcr_process_peer_cfg_req"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a172654cf1ffb8ea1e6c5f843f44de9a4a0eeef"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["158817495041906510911965844793965412587", "37587684898719464044817081512468193961", "318440218757037697366016955669440788412"], "threshold":0.9}, "id":"ASB-A-511263142-8ee98641", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a172654cf1ffb8ea1e6c5f843f44de9a4a0eeef", "target":{"file":"system/stack/l2cap/l2c_fcr.cc"}}, {"deprecated":false, "digest":{"function_hash":"82771970369623959507545372837089915813", "length":2517}, "id":"ASB-A-511263142-91ec30a5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a172654cf1ffb8ea1e6c5f843f44de9a4a0eeef", "target":{"file":"system/stack/l2cap/l2c_fcr.cc", "function":"l2c_fcr_process_peer_cfg_req"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ebc86d08f2eee64b468fae900311b94656ee7811"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["168556504593283868926714992799695355084", "6600388060011762667856770947447871709", "286451409060989210914113686422403817087"], "threshold":0.9}, "id":"ASB-A-511263142-3f5cd43d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ebc86d08f2eee64b468fae900311b94656ee7811", "target":{"file":"system/stack/l2cap/l2c_fcr.cc"}}, {"deprecated":false, "digest":{"function_hash":"170379592568063900264787715260528658019", "length":2692}, "id":"ASB-A-511263142-68653388", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ebc86d08f2eee64b468fae900311b94656ee7811", "target":{"file":"system/stack/l2cap/l2c_fcr.cc", "function":"l2c_fcr_process_peer_cfg_req"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33ab2593621afd66257b8ec469f2a2ac2f4ff083"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["168556504593283868926714992799695355084", "6600388060011762667856770947447871709", "286451409060989210914113686422403817087"], "threshold":0.9}, "id":"ASB-A-511263142-83113bd9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33ab2593621afd66257b8ec469f2a2ac2f4ff083", "target":{"file":"system/stack/l2cap/l2c_fcr.cc"}}, {"deprecated":false, "digest":{"function_hash":"278481947417331680563942531163900918557", "length":2676}, "id":"ASB-A-511263142-cb91f6c0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33ab2593621afd66257b8ec469f2a2ac2f4ff083", "target":{"file":"system/stack/l2cap/l2c_fcr.cc", "function":"l2c_fcr_process_peer_cfg_req"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5346ef0ebd56af28bdc14da0d77b5f43853bf02"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["159398918011162506279187512366821457941", "337394940854092034711896107288549428702", "266855468169604221462535693855786658067"], "threshold":0.9}, "id":"ASB-A-511263142-131f9369", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5346ef0ebd56af28bdc14da0d77b5f43853bf02", "target":{"file":"system/stack/l2cap/l2c_fcr.cc"}}, {"deprecated":false, "digest":{"function_hash":"244566742020578064108953421840380359437", "length":2388}, "id":"ASB-A-511263142-536114a3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5346ef0ebd56af28bdc14da0d77b5f43853bf02", "target":{"file":"system/stack/l2cap/l2c_fcr.cc", "function":"l2c_fcr_process_peer_cfg_req"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}