{"id":"ASB-A-499350302","details":"In multiple functions of llcp_core.c, there is a possible use after free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-499350302","CVE-2026-31629"],"modified":"2026-09-11T15:42:03.104094163Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-09-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32","target":{"file":"net/nfc/llcp_core.c"},"deprecated":false,"digest":{"line_hashes":["117597251946018665437928112260239859167","338763405237872142823783041372701021663","154213996783463988405856516206226229598","269161372471386964323475628739212820532","129732957878471811082413397089705113020","338763405237872142823783041372701021663","112092666315829322309908032682660975779","258962036401738939344496397501781392381"],"threshold":0.9},"id":"ASB-A-499350302-15120381","signature_type":"Line"},{"deprecated":false,"digest":{"length":1617,"function_hash":"227705798164377512225297760055285324836"},"id":"ASB-A-499350302-198e9167","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6","target":{"file":"net/nfc/llcp_core.c","function":"nfc_llcp_recv_hdlc"}},{"id":"ASB-A-499350302-64982fb7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32","target":{"file":"net/nfc/llcp_core.c","function":"nfc_llcp_recv_hdlc"},"deprecated":false,"digest":{"function_hash":"227705798164377512225297760055285324836","length":1617}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6","target":{"file":"net/nfc/llcp_core.c","function":"nfc_llcp_recv_disc"},"deprecated":false,"digest":{"function_hash":"206633983744377399509200545532643680025","length":766},"id":"ASB-A-499350302-8faf8831","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["117597251946018665437928112260239859167","338763405237872142823783041372701021663","154213996783463988405856516206226229598","269161372471386964323475628739212820532","129732957878471811082413397089705113020","338763405237872142823783041372701021663","112092666315829322309908032682660975779","258962036401738939344496397501781392381"],"threshold":0.9},"id":"ASB-A-499350302-a9a48882","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6","target":{"file":"net/nfc/llcp_core.c"}},{"deprecated":false,"digest":{"length":766,"function_hash":"206633983744377399509200545532643680025"},"id":"ASB-A-499350302-f28c98bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32","target":{"file":"net/nfc/llcp_core.c","function":"nfc_llcp_recv_disc"}}],"fixes":["https://android.googlesource.com/kernel/common/+/4642ec2b3fdc3289192d3970b5baf6aa14031c32","https://android.googlesource.com/kernel/common/+/3bcdd92440376888cb93464c916876a581e39ed6"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-499350302.json"}}],"schema_version":"1.9.0"}