{"schema_version":"1.7.5","id":"ASB-A-440544511","published":"2026-03-01T00:00:00Z","modified":"2026-07-24T16:43:26.002557455Z","aliases":["A-440544511","CVE-2025-39682"],"details":"In tls_sw_recvmsg of tls_sw.c, there is a possible use after free due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f","https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325","https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9"],"severity":"High","spl":"2026-03-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["210470432917378961937970210927904831680","84339291339852320171267991366724356407","185900558359748310197105066423877846560","215957116333048059581279646975504422977","174746277208481714893019129100718364122","303950792685140853573157546148824440606","217097369404115410319866980071705788520","91276297070775003702396250879657802873"],"threshold":0.9},"id":"ASB-A-440544511-19ae1639","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f","target":{"file":"net/tls/tls_sw.c"}},{"deprecated":false,"digest":{"line_hashes":["210470432917378961937970210927904831680","84339291339852320171267991366724356407","185900558359748310197105066423877846560","215957116333048059581279646975504422977","174746277208481714893019129100718364122","303950792685140853573157546148824440606","217097369404115410319866980071705788520","91276297070775003702396250879657802873"],"threshold":0.9},"id":"ASB-A-440544511-2ef3e627","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325","target":{"file":"net/tls/tls_sw.c"}},{"deprecated":false,"digest":{"function_hash":"79384366739083965612613764256551849423","length":3717},"id":"ASB-A-440544511-305bae70","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9","target":{"file":"net/tls/tls_sw.c","function":"tls_sw_recvmsg"}},{"deprecated":false,"digest":{"function_hash":"324708666569232731175142375604768210644","length":3727},"id":"ASB-A-440544511-58dc60f2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f","target":{"file":"net/tls/tls_sw.c","function":"tls_sw_recvmsg"}},{"deprecated":false,"digest":{"line_hashes":["210470432917378961937970210927904831680","84339291339852320171267991366724356407","185900558359748310197105066423877846560","215957116333048059581279646975504422977","174746277208481714893019129100718364122","303950792685140853573157546148824440606","217097369404115410319866980071705788520","91276297070775003702396250879657802873"],"threshold":0.9},"id":"ASB-A-440544511-6cfba1ef","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9","target":{"file":"net/tls/tls_sw.c"}},{"deprecated":false,"digest":{"function_hash":"324708666569232731175142375604768210644","length":3727},"id":"ASB-A-440544511-b03d45eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325","target":{"file":"net/tls/tls_sw.c","function":"tls_sw_recvmsg"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-440544511.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9"}]}