{"id":"ASB-A-498371235","details":"In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-498371235","CVE-2026-58942"],"modified":"2026-11-02T16:56:16.514039698Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":731,"function_hash":"54641339401774263650370781699250857284"},"id":"ASB-A-498371235-0e2a9cb5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f","target":{"function":"do_fault_around","file":"mm/memory.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","target":{"file":"mm/memory.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335005123885143385767006061691967092293","57367293971869288443827641052309497977","118959919782105360570205502162670195986","13308996826925379391794621566570904083","323157253887917129352491477785697135330","277778080932326382533191655658139352233","84411702661768995662438030294779814762","85956386676670030312695502482596184283","172296345848558093735429897288925004762","284321043766182342738473926992583103122"]},"id":"ASB-A-498371235-13929f83"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","target":{"function":"do_fault_around","file":"mm/memory.c"},"deprecated":false,"digest":{"function_hash":"54641339401774263650370781699250857284","length":731},"id":"ASB-A-498371235-4393ff30"},{"target":{"file":"mm/memory.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335005123885143385767006061691967092293","57367293971869288443827641052309497977","118959919782105360570205502162670195986","13308996826925379391794621566570904083","323157253887917129352491477785697135330","277778080932326382533191655658139352233","84411702661768995662438030294779814762","85956386676670030312695502482596184283","172296345848558093735429897288925004762","284321043766182342738473926992583103122"]},"id":"ASB-A-498371235-f8e96d1e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f"}],"fixes":["https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f"],"severity":"High","spl":"2026-11-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498371235.json"}}],"schema_version":"1.9.2"}