{"id":"ASB-A-499359964","details":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-499359964","CVE-2026-58827"],"modified":"2026-11-02T16:56:18.894885896Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"High","spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":1405,"function_hash":"110119949003007147025732269034498067476"},"id":"ASB-A-499359964-098af70a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","target":{"function":"dma_buf_begin_new_exec","file":"drivers/dma-buf/dma-buf.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79","target":{"file":"drivers/dma-buf/dma-buf.c","function":"dup_dma_buf_info"},"deprecated":false,"digest":{"length":1031,"function_hash":"188539048586863725890419097264370020252"},"id":"ASB-A-499359964-2ab600bd"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79","target":{"file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["277603533942831042957838684450805672489","131335301546573244224465578611784889497","330546395922362878290460987340422764330","186428463664412723929277109102780364377","68062566739193187382204446502280043008","72769656723554965202482409385968309962","38424048196255626444130381228031591148","304184781350158152821097057269691594965","151625118768689803590014979851687732230","331130367926654226995620745196390117994","150710803783458465005863294699009185487","340178583577228998947660012059471648381","91957248958510249059222787274901673873","281195732600067785114343108806129240130","206980953843095613535268319364595477085","326683770769006290140298279008026642876","185905442924254399759205596753210145841","245430485549501393490080528711126033729","29695344557455531578645440405051306168","58849427221100016038019995052542347919","331175882966102025993177671635638635917","118204895782943632752166350183493714065","1119602260907598637456402240494233805","190455081888449251604094195247424027135","338344862870060663960570789828293441187","306527920178083607657668765484659109600","5173922179103631259361437092914264977","102415012969978275600873468636652983860","93959454523220682406630252148637652025","321541551899181617745674301594112315511","214007207821586316672526124764442133586","294909693843627200380987820096383520284","321270013595618982131078441792431698921","282807733230106630613711509347927128668","262035659345876601404956932448352575854","98474845968899156174544017026988716600","193006981246506715978661341836466572322","283827352530074408064833119710169406835","86083725320611899670925478178621824560","166348958741955914105068745625470481723","124153149903163751390572925124905677395","40643795074385766927239435003604463576","224241419619181295386641260662036620791","95176798222403168910570895487200505537","96622909971711903870980132387947758182","143492913515266206060493034582173031417","334956775824397418502850939934351192096","303117742708575597527481657004126316670","186899200402398320261080956824820428908","144925213240813340675833297931077428876","243647154178170698011337974724886411125","174681300190455605184537775634796533392","244082899582243488679643187363998483750","135975176645064080784319480409372126907","6656009620071722262898265546028051753","182795118434698918247413354876311030720","116555895217447529774855995154607405320","32498471154664150952214552996299539566","14077501808074635048662467662499949871","203822638183424754996112104752538307042","243124935384298352572198521043304964238","67432646285428215482002203964939601904","284677629639334370298243113210886764123","88284404857339978816800594827858077191","212050929006309952893176550566020063688","110116365338128676460524553697840703353","229446826618053655721013982654186700996","89008197465321445437903321221028953488","84629107463580651133289858066878275048","139008816174467562375611502776526404606","296833941637323677632055537382889884681","176610308536974784043080376527110852433","138416230311545591841184864861372797191","259881131239747064783565621423245119960","62360542105451417576563909260597020875","209587067186353718523861596885105739184"]},"id":"ASB-A-499359964-389f729b"},{"target":{"function":"copy_dmabuf_info","file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"length":894,"function_hash":"190093120867025615620958954052313688392"},"id":"ASB-A-499359964-453907bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"},{"target":{"file":"drivers/dma-buf/dma-buf.c","function":"copy_dmabuf_info"},"deprecated":false,"digest":{"function_hash":"190093120867025615620958954052313688392","length":894},"id":"ASB-A-499359964-a75e4fd1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67"},{"digest":{"function_hash":"188539048586863725890419097264370020252","length":1031},"id":"ASB-A-499359964-c003348f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","target":{"function":"dup_dma_buf_info","file":"drivers/dma-buf/dma-buf.c"},"deprecated":false},{"id":"ASB-A-499359964-d3e3f1f7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79","target":{"file":"drivers/dma-buf/dma-buf.c","function":"dma_buf_begin_new_exec"},"deprecated":false,"digest":{"length":1414,"function_hash":"225622031139676927674407951822210662415"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","target":{"file":"drivers/dma-buf/dma-buf.c"},"deprecated":false,"digest":{"line_hashes":["277603533942831042957838684450805672489","131335301546573244224465578611784889497","330546395922362878290460987340422764330","186428463664412723929277109102780364377","68062566739193187382204446502280043008","72769656723554965202482409385968309962","38424048196255626444130381228031591148","304184781350158152821097057269691594965","151625118768689803590014979851687732230","331130367926654226995620745196390117994","150710803783458465005863294699009185487","340178583577228998947660012059471648381","91957248958510249059222787274901673873","281195732600067785114343108806129240130","206980953843095613535268319364595477085","326683770769006290140298279008026642876","185905442924254399759205596753210145841","245430485549501393490080528711126033729","29695344557455531578645440405051306168","58849427221100016038019995052542347919","331175882966102025993177671635638635917","118204895782943632752166350183493714065","1119602260907598637456402240494233805","190455081888449251604094195247424027135","338344862870060663960570789828293441187","306527920178083607657668765484659109600","5173922179103631259361437092914264977","102415012969978275600873468636652983860","93959454523220682406630252148637652025","321541551899181617745674301594112315511","214007207821586316672526124764442133586","294909693843627200380987820096383520284","321270013595618982131078441792431698921","282807733230106630613711509347927128668","262035659345876601404956932448352575854","98474845968899156174544017026988716600","193006981246506715978661341836466572322","283827352530074408064833119710169406835","86083725320611899670925478178621824560","166348958741955914105068745625470481723","124153149903163751390572925124905677395","40643795074385766927239435003604463576","224241419619181295386641260662036620791","95176798222403168910570895487200505537","96622909971711903870980132387947758182","143492913515266206060493034582173031417","334956775824397418502850939934351192096","303117742708575597527481657004126316670","186899200402398320261080956824820428908","144925213240813340675833297931077428876","243647154178170698011337974724886411125","174681300190455605184537775634796533392","47924997892945092873178515816875229222","231340024121044950513424136614065107421","331829799688979058998164147519664757776","36489253161055773925131862232469378208","180897225690015223618552016069118482956","307339248818513031502909675065252454208","274534675281710921837262259161157151150","257719670994824661356995096829100246865","124580340377956256297005263995460072746","266268290686737077052414475265374153452","283588449273596647362240723867181471082","175899387648126655496169631332108853816","317971906460402456071191639102307919506","336346420105769387489505430571704117680","249163552371416464398509391681322755411","127410617686265236596818649379579782386","74325177004118465905261996477067742796","257144049563657389614116879692253195475","46333189980679469885261103641684637594","24413156086886296011376641570035711374"],"threshold":0.9},"id":"ASB-A-499359964-d66f022f"},{"target":{"file":"drivers/dma-buf/dma-buf.c","function":"count_dmabuf_fds"},"deprecated":false,"digest":{"function_hash":"252275729554611972062542650401353380833","length":325},"id":"ASB-A-499359964-ec872bd2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"}],"fixes":["https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-499359964.json"}}],"schema_version":"1.9.2"}