{"id":"ASB-A-499361237","details":"In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-499361237","CVE-2026-58825"],"modified":"2026-11-02T17:11:24.836393767Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"31936906226223388559417505331229953252","length":1623},"id":"ASB-A-499361237-25b0498e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","target":{"file":"kernel/fork.c","function":"ksys_unshare"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","target":{"file":"kernel/fork.c","function":"ksys_unshare"},"deprecated":false,"digest":{"function_hash":"31936906226223388559417505331229953252","length":1623},"id":"ASB-A-499361237-266f5cb5","signature_type":"Function"},{"deprecated":false,"digest":{"length":339,"function_hash":"90626034782223937776344355026251456313"},"id":"ASB-A-499361237-4afe1c41","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","target":{"file":"kernel/fork.c","function":"unshare_files"}},{"digest":{"line_hashes":["36068004602098560576594699183806772271","316419745042241145310504515138626807881","100954991621458826644375534037386094047","46337904111734924205258547885548600621","175929497002181099523772028967212025801","52374567015430585028108369470043628376","305256934718450275009964286259335414416","5558400927124673955651212891260072071","136347096054282790423764663137901663334","197837629402375992007431637035318602768","217602315266044471657097891911591037663","302763030707065359873618064654383779343","128211658509124824326653110876134760903","92713346458958093106007064821078121218","121142000825365544902605149996497899355","176249126497731351457524210261102813352","325693500623688951029903857434003192059","32985780935236629985737385441043322827","82161613025239288555498243203183849198","292097578203805099167132776224033645875"],"threshold":0.9},"id":"ASB-A-499361237-cfe87e21","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","target":{"file":"kernel/fork.c"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","target":{"file":"kernel/fork.c","function":"unshare_files"},"deprecated":false,"digest":{"length":339,"function_hash":"90626034782223937776344355026251456313"},"id":"ASB-A-499361237-d4c4c6ea","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["36068004602098560576594699183806772271","316419745042241145310504515138626807881","100954991621458826644375534037386094047","46337904111734924205258547885548600621","175929497002181099523772028967212025801","52374567015430585028108369470043628376","305256934718450275009964286259335414416","5558400927124673955651212891260072071","136347096054282790423764663137901663334","197837629402375992007431637035318602768","217602315266044471657097891911591037663","302763030707065359873618064654383779343","128211658509124824326653110876134760903","92713346458958093106007064821078121218","121142000825365544902605149996497899355","176249126497731351457524210261102813352","325693500623688951029903857434003192059","32985780935236629985737385441043322827","82161613025239288555498243203183849198","292097578203805099167132776224033645875"]},"id":"ASB-A-499361237-f5b99c8c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","target":{"file":"kernel/fork.c"}}],"fixes":["https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-499361237.json"}}],"schema_version":"1.9.2"}