{"id":"ASB-A-496407345","details":"In remove_waiter of rtmutex.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-496407345","CVE-2026-43499"],"modified":"2026-11-04T16:48:29.960526221Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7","https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6","https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f","https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1"],"severity":"High","spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"321623487731059697462659176703519390621","length":753},"id":"ASB-A-496407345-110d7f34","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6","target":{"file":"kernel/locking/rtmutex.c","function":"remove_waiter"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7","target":{"file":"kernel/locking/rtmutex_api.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["98042712526789370733806478659557162825","126676874583107820258592533601385840698","19642359851191854621195812806741186124","14609262171748844005021633772876798503"]},"id":"ASB-A-496407345-22c319b3"},{"source":"https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7","target":{"file":"kernel/locking/rtmutex_api.c","function":"rt_mutex_start_proxy_lock"},"deprecated":false,"digest":{"function_hash":"8865747388681679273238240347913336704","length":348},"id":"ASB-A-496407345-393a44ac","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f","target":{"file":"kernel/locking/rtmutex_api.c","function":"rt_mutex_start_proxy_lock"},"deprecated":false,"digest":{"length":261,"function_hash":"121474958323146197188754889206337478448"},"id":"ASB-A-496407345-751e280f","signature_type":"Function"},{"id":"ASB-A-496407345-7c808baf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1","target":{"function":"remove_waiter","file":"kernel/locking/rtmutex.c"},"deprecated":false,"digest":{"length":753,"function_hash":"321623487731059697462659176703519390621"}},{"source":"https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6","target":{"file":"kernel/locking/rtmutex.c"},"deprecated":false,"digest":{"line_hashes":["84269936625604621200357597489841864462","72332967552365167678396858751267270359","123144722431976731585365432604424527191","53371536021202348677362757505832586433","307527933472384961818192845659133641107","203245035530162826384709227839934427850","75116793936665624820930136254857920437","256177438596760873311434396465664240989","27332636958692321789847883230970156358","9618425157490490837031240458221865987","96231594927069690110890544437447439402","71297725183417811193672019410092583209","209604960097474086482785295245154164400","140010148176648859616308240417706375647","161362430862471991036898901121823974006","209761725319832223996862197605802485380","1831840297024962081632188923952264414","302421641651323288913677140077751470820"],"threshold":0.9},"id":"ASB-A-496407345-9610b5e9","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1","target":{"file":"kernel/locking/rtmutex.c"},"deprecated":false,"digest":{"line_hashes":["84269936625604621200357597489841864462","72332967552365167678396858751267270359","123144722431976731585365432604424527191","53371536021202348677362757505832586433","307527933472384961818192845659133641107","203245035530162826384709227839934427850","75116793936665624820930136254857920437","256177438596760873311434396465664240989","27332636958692321789847883230970156358","9618425157490490837031240458221865987","96231594927069690110890544437447439402","71297725183417811193672019410092583209","209604960097474086482785295245154164400","140010148176648859616308240417706375647","161362430862471991036898901121823974006","209761725319832223996862197605802485380","1831840297024962081632188923952264414","302421641651323288913677140077751470820"],"threshold":0.9},"id":"ASB-A-496407345-de29bd9c","signature_type":"Line"},{"digest":{"line_hashes":["128606081143331584820015410938333341431","59503128719007975942250479901900872536","253704620930610164433288176540467167698","59439083731474349844524076548377312763"],"threshold":0.9},"id":"ASB-A-496407345-f92f72fd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f","target":{"file":"kernel/locking/rtmutex_api.c"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496407345.json"}}],"schema_version":"1.9.2"}