{"id":"ASB-A-440544511","details":"In tls_sw_recvmsg of tls_sw.c, there is a possible use after free due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-440544511","CVE-2025-39682"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"High","spl":"2026-03-05","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["210470432917378961937970210927904831680","84339291339852320171267991366724356407","185900558359748310197105066423877846560","215957116333048059581279646975504422977","174746277208481714893019129100718364122","303950792685140853573157546148824440606","217097369404115410319866980071705788520","91276297070775003702396250879657802873"],"threshold":0.9},"id":"ASB-A-440544511-19ae1639","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f","target":{"file":"net/tls/tls_sw.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325","target":{"file":"net/tls/tls_sw.c"},"deprecated":false,"digest":{"line_hashes":["210470432917378961937970210927904831680","84339291339852320171267991366724356407","185900558359748310197105066423877846560","215957116333048059581279646975504422977","174746277208481714893019129100718364122","303950792685140853573157546148824440606","217097369404115410319866980071705788520","91276297070775003702396250879657802873"],"threshold":0.9},"id":"ASB-A-440544511-2ef3e627"},{"digest":{"length":3717,"function_hash":"79384366739083965612613764256551849423"},"id":"ASB-A-440544511-305bae70","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9","target":{"file":"net/tls/tls_sw.c","function":"tls_sw_recvmsg"},"deprecated":false},{"digest":{"function_hash":"324708666569232731175142375604768210644","length":3727},"id":"ASB-A-440544511-58dc60f2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f","target":{"file":"net/tls/tls_sw.c","function":"tls_sw_recvmsg"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9","target":{"file":"net/tls/tls_sw.c"},"deprecated":false,"digest":{"line_hashes":["210470432917378961937970210927904831680","84339291339852320171267991366724356407","185900558359748310197105066423877846560","215957116333048059581279646975504422977","174746277208481714893019129100718364122","303950792685140853573157546148824440606","217097369404115410319866980071705788520","91276297070775003702396250879657802873"],"threshold":0.9},"id":"ASB-A-440544511-6cfba1ef","signature_type":"Line"},{"source":"https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325","target":{"file":"net/tls/tls_sw.c","function":"tls_sw_recvmsg"},"deprecated":false,"digest":{"length":3727,"function_hash":"324708666569232731175142375604768210644"},"id":"ASB-A-440544511-b03d45eb","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/kernel/common/+/2902c3ebcca52ca845c03182000e8d71d3a5196f","https://android.googlesource.com/kernel/common/+/74715c47d57ccbff2f2f00bb9d87288e10642325","https://android.googlesource.com/kernel/common/+/3439c15ae91a517cf3c650ea15a8987699416ad9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-440544511.json"}}],"schema_version":"1.9.0"}