{"id":"ASB-A-496996374","details":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-496996374","CVE-2026-58828"],"modified":"2026-11-02T16:56:21.824734201Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","target":{"file":"fs/proc/base.c","function":"proc_dmabuf_rss_hwm_write"},"deprecated":false,"digest":{"function_hash":"121190633109205899953018928365355650915","length":594},"id":"ASB-A-496996374-11302d16","signature_type":"Function"},{"source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","target":{"file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"line_hashes":["144936424875811636287705786150353673968","193640744968449661777083207105905809137","299896499794028104631689595446669035771","272432629865637191856611218803271151597","226390761541095895755253361876323722126","20559885785573028659648299800603450754","95318548099141040220293266080406827492","43737509820338364094733693070923175191","234009470208959458936162923735511832639","156181208561615064087611977908795030348","280203882091208619254828442542974097533","278117699771744405403186539691044548754","85237824290835710938022198621082637090","237769578407080893830962575730478284535","268120321645251405815550883375355122918","167192486604112899205519650290982623893","97046674405439118081313886115130327206","180140536229288444871721167892889970230","198381673266873547147269856251311294816","268513839978389749064880895872826681835"],"threshold":0.9},"id":"ASB-A-496996374-1ed11a49","signature_type":"Line","signature_version":"v1"},{"target":{"file":"fs/exec.c"},"deprecated":false,"digest":{"line_hashes":["78786539497702727321237285770681435775","280139830888195220900443992078443695244","17346355164411878187150541093664590268","224020872850687490997946507700089308464"],"threshold":0.9},"id":"ASB-A-496996374-21f247cb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec"},{"id":"ASB-A-496996374-4861ee48","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","target":{"file":"drivers/dma-buf/dma-buf.c","function":"dma_buf_begin_new_exec"},"deprecated":false,"digest":{"length":1422,"function_hash":"248059202061468838994410823473711354318"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","target":{"file":"drivers/dma-buf/dma-buf.c","function":"copy_dmabuf_info"},"deprecated":false,"digest":{"length":896,"function_hash":"189961905232342297289362512273965597249"},"id":"ASB-A-496996374-4cc3de8c","signature_type":"Function"},{"target":{"function":"proc_dmabuf_rss_show","file":"fs/proc/base.c"},"deprecated":false,"digest":{"length":281,"function_hash":"271260972701587667592849511978718897271"},"id":"ASB-A-496996374-5b2d9a14","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","target":{"function":"begin_new_exec","file":"fs/exec.c"},"deprecated":false,"digest":{"function_hash":"58540592252209991772233641989165951864","length":2462},"id":"ASB-A-496996374-5f8d39b7"},{"id":"ASB-A-496996374-6e2700bf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","target":{"file":"include/linux/dma-buf.h"},"deprecated":false,"digest":{"line_hashes":["150897546058855192822105379004755775362","306471992944050290386750344091053770877","286314856623747736969668499873686025141","67686813509375155867739506828129164153","38791968758714814023245013737070621734","8518798096083093472433927346636057565","55524714265381825010954543508492964730","182310298788695267619671647516524666990"],"threshold":0.9}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131975753623824420162687009935328382818","162137633766565095693676351096445901037","32789971619356297414089250503443553533","200649329229004990207066373882049795879","298368871858772042581334382338036996444","254574555862376300625671641626990281221","222045387507894336046347054555806903586","2408186557196166866561335840006688382","131227709707329527017193425109498863248"]},"id":"ASB-A-496996374-8af51bb9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","target":{"file":"fs/file.c"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","target":{"file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"line_hashes":["144936424875811636287705786150353673968","193640744968449661777083207105905809137","299896499794028104631689595446669035771","272432629865637191856611218803271151597","226390761541095895755253361876323722126","20559885785573028659648299800603450754","95318548099141040220293266080406827492","43737509820338364094733693070923175191","234009470208959458936162923735511832639","156181208561615064087611977908795030348","280203882091208619254828442542974097533","278117699771744405403186539691044548754","85237824290835710938022198621082637090","237769578407080893830962575730478284535","268120321645251405815550883375355122918","167192486604112899205519650290982623893","97046674405439118081313886115130327206","180140536229288444871721167892889970230","198381673266873547147269856251311294816","268513839978389749064880895872826681835"],"threshold":0.9},"id":"ASB-A-496996374-94020c95","signature_type":"Line"},{"source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","target":{"function":"dma_buf_begin_new_exec","file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"function_hash":"136469235886032324486746894507336076993","length":1443},"id":"ASB-A-496996374-94e85d55","signature_type":"Function","signature_version":"v1"},{"target":{"function":"copy_dmabuf_info","file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"function_hash":"189961905232342297289362512273965597249","length":896},"id":"ASB-A-496996374-9ba9406b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","target":{"function":"begin_new_exec","file":"fs/exec.c"},"deprecated":false,"digest":{"length":2662,"function_hash":"143809144763114874850666550851923264010"},"id":"ASB-A-496996374-9c24c8bc","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","target":{"file":"fs/proc/base.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205457595181696799063232546860476232689","103243046092815755453484235521246321604","221767705692847563287911724819457333984","308490989939033244539268263493676286","326603831601775049067050821127060541334","133743730637042434718245541132060346930","102690074702297272000825115544846209448","130887867609847948976152231101798961851","147212790168001947482556077408503083417","15895565140645480901922466084841117879","129030590312784188693838291227564676164","144570105669548695196431982563624401688","320212961159511146954905964358663201192","205073558504130261126600206343989803656","17592154405326111016054138358863234504","187653607181258467555659737142638140818","75253645107116207764080428742058374419","202890410140974152092826948666837156872","166785272356280755627241846045533350888","311468361170004182952629208524858680975","155114514182380041416295704600821267226","220516774844930688962829667144673575289","829114396436236611439531111316975696","63029633312844925762211410757321529092","138841833405423142034008974247164578310","174940105529124051924532248171946297485","205867656050941598634302320153673469178","196252513212567354489694540348366582483","124894619014030146421407342864793345825","314193527500390939716097177447025190841","254650944108796244555409426822525270851","248753202264697735093549444896814987420","199719892909004446771714948613705010901","134408722328050922849706416102781630913","186859026706520108085868455850815054906","183078112883946983001824338811911419035","134508974508821255601391485548780497101","325369267095775560093735489860683322148","4072186091109265168197235197156565483","240041502979313409825967993874439979852","99495343667143400627788758879337524921","46405056100023397418190771102364671374","44594906358008386509241511775963084800","76999258547185503417883516457065795147","6711032115353364449709433140377279772","132404261783289554030836036015584001256","20273857640975413189028029618700603674","309061479344305652406942526283293732267","222281025600138647922102451156284187362","198184730594064549605192615355663081036","297097779157952486398537049973228635149"]},"id":"ASB-A-496996374-b1727494","signature_type":"Line"},{"digest":{"function_hash":"143326892560020181287838206324621205155","length":1431},"id":"ASB-A-496996374-c0b8f872","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","target":{"function":"dma_buf_begin_new_exec","file":"drivers/dma-buf/dma-buf.c"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","target":{"file":"fs/proc/base.c","function":"proc_dmabuf_rss_hwm_show"},"deprecated":false,"digest":{"length":419,"function_hash":"287285015384535246708137527890147774352"},"id":"ASB-A-496996374-c8129159","signature_type":"Function"},{"source":"https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","target":{"file":"include/linux/dma-buf.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["150897546058855192822105379004755775362","306471992944050290386750344091053770877","286314856623747736969668499873686025141","67686813509375155867739506828129164153","38791968758714814023245013737070621734","8518798096083093472433927346636057565","55524714265381825010954543508492964730","182310298788695267619671647516524666990"]},"id":"ASB-A-496996374-d49ffde4","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","target":{"file":"fs/exec.c"},"deprecated":false,"digest":{"line_hashes":["78786539497702727321237285770681435775","280139830888195220900443992078443695244","17346355164411878187150541093664590268","224020872850687490997946507700089308464"],"threshold":0.9},"id":"ASB-A-496996374-d7052050","signature_type":"Line"},{"deprecated":false,"digest":{"length":841,"function_hash":"317454051753243813188455259495752872078"},"id":"ASB-A-496996374-d810900d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","target":{"file":"fs/file.c","function":"__close_range"}},{"target":{"function":"proc_dmabuf_pss_show","file":"fs/proc/base.c"},"deprecated":false,"digest":{"function_hash":"108185142787900855411445728845277365477","length":565},"id":"ASB-A-496996374-ea1a1ceb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527"}],"fixes":["https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496996374.json"}}],"schema_version":"1.9.2"}