{"schema_version":"1.7.5","id":"ASB-A-440544812","published":"2026-03-01T00:00:00Z","modified":"2026-07-24T16:43:26.002557455Z","aliases":["A-440544812","CVE-2025-38616"],"details":"In multiple locations, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859","https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155"],"severity":"High","spl":"2026-03-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["170508798166172314097597771353826620430","89342480764029246621056754936418984144","248220330052947097772732175895273315012","249915814839611507282989559303303507484"],"threshold":0.9},"id":"ASB-A-440544812-0dd51c5f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155","target":{"file":"net/tls/tls.h"}},{"deprecated":false,"digest":{"line_hashes":["226789466788195715266226247721324978635","144738273004732636692222213719682687030","58658334836049400729999299682353487934","190429337757357799360445297747204015086","315649370303442028950751356011208452455","303256381557469460551095301393341350636","58761924555323761458855217903038601454","63723652160737214137071628994587564734","16685416554596044550613339127645693179","318534184604709186115691318075725179658","260279685781214014396767371971266917893","65084346358647903366604779303693785078","253424568446679716004343652798105549446"],"threshold":0.9},"id":"ASB-A-440544812-1088cf5f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155","target":{"file":"net/tls/tls_strp.c"}},{"deprecated":false,"digest":{"line_hashes":["226789466788195715266226247721324978635","144738273004732636692222213719682687030","58658334836049400729999299682353487934","190429337757357799360445297747204015086","315649370303442028950751356011208452455","303256381557469460551095301393341350636","58761924555323761458855217903038601454","63723652160737214137071628994587564734","16685416554596044550613339127645693179","318534184604709186115691318075725179658","260279685781214014396767371971266917893","65084346358647903366604779303693785078","253424568446679716004343652798105549446"],"threshold":0.9},"id":"ASB-A-440544812-10fc3e80","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859","target":{"file":"net/tls/tls_strp.c"}},{"deprecated":false,"digest":{"line_hashes":["284671514526104341197031149636661347225","172083881392321770836369430485016121290","244901425473858676203972010086032968956","125587834902297792702560988887903907419"],"threshold":0.9},"id":"ASB-A-440544812-56ff753a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155","target":{"file":"net/tls/tls_sw.c"}},{"deprecated":false,"digest":{"function_hash":"91592170196266127229216292152298278232","length":514},"id":"ASB-A-440544812-72227ff5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859","target":{"file":"net/tls/tls_strp.c","function":"tls_strp_msg_load"}},{"deprecated":false,"digest":{"line_hashes":["284671514526104341197031149636661347225","172083881392321770836369430485016121290","244901425473858676203972010086032968956","125587834902297792702560988887903907419"],"threshold":0.9},"id":"ASB-A-440544812-72f35f75","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859","target":{"file":"net/tls/tls_sw.c"}},{"deprecated":false,"digest":{"function_hash":"77474952819869977334046236629670671947","length":1040},"id":"ASB-A-440544812-87c29c16","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155","target":{"file":"net/tls/tls_sw.c","function":"tls_rx_rec_wait"}},{"deprecated":false,"digest":{"function_hash":"77474952819869977334046236629670671947","length":1040},"id":"ASB-A-440544812-96d8d67c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859","target":{"file":"net/tls/tls_sw.c","function":"tls_rx_rec_wait"}},{"deprecated":false,"digest":{"line_hashes":["170508798166172314097597771353826620430","89342480764029246621056754936418984144","248220330052947097772732175895273315012","249915814839611507282989559303303507484"],"threshold":0.9},"id":"ASB-A-440544812-e3ab5908","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859","target":{"file":"net/tls/tls.h"}},{"deprecated":false,"digest":{"function_hash":"91592170196266127229216292152298278232","length":514},"id":"ASB-A-440544812-e3ef827c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155","target":{"file":"net/tls/tls_strp.c","function":"tls_strp_msg_load"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-440544812.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f1fe99919f629f980d0b8a7ff16950bffe06a859"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155"}]}