{"id":"ASB-A-489036052","details":"In logi_dj_probe of hid-logitech-dj.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-489036052","CVE-2026-64427"],"modified":"2026-11-05T16:32:28.703711716Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/c47a6316399f7dfbddb1d383578838e3969ae90f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5db2dcc7b20c370157de9a46978d5a3d005b169c"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/a1f098e5a82ad297062244ee20a44b6131c199c1"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2b71b414641a5cac8a3bf2a736518e09a73badf5"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2b71b414641a5cac8a3bf2a736518e09a73badf5","target":{"file":"drivers/hid/hid-logitech-dj.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["340215990362575188973508260586870994715","63183454383030324871899403167023556513","190080670770210385505531757060346883680","275614720648815378961248126820803083600","96426450544813789957816404461859648627","164864472289946004093544157643867715957","204278942218713104271161147033169866530","297971088892453897446678769591357791711","335154687195259287737458056100516791818","310691086589449036332350407205234219396","213309331825620047631057825060354168313","207048503474081623595343351867269951546","66509561907561480247599337972372402873","158980291156439085660719555716175021523","38302755505301350646471775696505077552","8949922676151344661182002519421110912","12627243266421778123030425707825799013","5430620074926550738449180198898223131","326076827521064487102033330909101746401"]},"id":"ASB-A-489036052-3109d4ca","signature_type":"Line"},{"digest":{"line_hashes":["239376281237100324232258991761957438419","256891356508157938181854098198998064635","183669323355434746929820750661357422404","141031170353821710641307093482238103287"],"threshold":0.9},"id":"ASB-A-489036052-6f31a5ce","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45","target":{"file":"drivers/hid/hid-logitech-dj.c"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45","target":{"file":"drivers/hid/hid-logitech-dj.c","function":"logi_dj_probe"},"deprecated":false,"digest":{"length":2577,"function_hash":"210008752323922029594929459506713429218"},"id":"ASB-A-489036052-7e4d6f70","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-489036052-a1d67ac1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7","target":{"file":"drivers/hid/hid-logitech-dj.c","function":"logi_dj_probe"},"deprecated":false,"digest":{"length":2577,"function_hash":"210008752323922029594929459506713429218"}},{"id":"ASB-A-489036052-c61db7b7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7","target":{"file":"drivers/hid/hid-logitech-dj.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["239376281237100324232258991761957438419","256891356508157938181854098198998064635","183669323355434746929820750661357422404","141031170353821710641307093482238103287"]}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5db2dcc7b20c370157de9a46978d5a3d005b169c","target":{"file":"drivers/hid/hid-logitech-dj.c"},"deprecated":false,"digest":{"line_hashes":["340215990362575188973508260586870994715","63183454383030324871899403167023556513","190080670770210385505531757060346883680","275614720648815378961248126820803083600","96426450544813789957816404461859648627","164864472289946004093544157643867715957","204278942218713104271161147033169866530","297971088892453897446678769591357791711","335154687195259287737458056100516791818","310691086589449036332350407205234219396","213309331825620047631057825060354168313","207048503474081623595343351867269951546","66509561907561480247599337972372402873","158980291156439085660719555716175021523","38302755505301350646471775696505077552","8949922676151344661182002519421110912","12627243266421778123030425707825799013","5430620074926550738449180198898223131","326076827521064487102033330909101746401"],"threshold":0.9},"id":"ASB-A-489036052-fc4e811c"}],"fixes":["https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7","https://android.googlesource.com/kernel/common/+/c47a6316399f7dfbddb1d383578838e3969ae90f","https://android.googlesource.com/kernel/common/+/5db2dcc7b20c370157de9a46978d5a3d005b169c","https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45","https://android.googlesource.com/kernel/common/+/a1f098e5a82ad297062244ee20a44b6131c199c1","https://android.googlesource.com/kernel/common/+/2b71b414641a5cac8a3bf2a736518e09a73badf5"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-489036052.json"}}],"schema_version":"1.9.2"}