{"id":"ASB-A-500022799","details":"In tipc_buf_append of msg.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-500022799","CVE-2026-52993"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-09-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-05","types":["RCE"],"vanir_signatures":[{"digest":{"function_hash":"174027384355739275013206633683574555107","length":1261},"id":"ASB-A-500022799-507459db","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c","target":{"file":"net/tipc/msg.c","function":"tipc_buf_append"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c","target":{"file":"net/tipc/msg.c"},"deprecated":false,"digest":{"line_hashes":["97423760747217642517742387495835668389","14278505440988646182880112207177411372","106901716513671116461506560072627084916","100336213267718126617818844093329217311","29235504496700833827974129505928782930"],"threshold":0.9},"id":"ASB-A-500022799-53b63d18"},{"id":"ASB-A-500022799-a6710fdc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d","target":{"file":"net/tipc/msg.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["97423760747217642517742387495835668389","14278505440988646182880112207177411372","106901716513671116461506560072627084916","100336213267718126617818844093329217311","29235504496700833827974129505928782930"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d","target":{"file":"net/tipc/msg.c","function":"tipc_buf_append"},"deprecated":false,"digest":{"length":1261,"function_hash":"174027384355739275013206633683574555107"},"id":"ASB-A-500022799-eb3e7c6b"}],"fixes":["https://android.googlesource.com/kernel/common/+/b5d8f34c67b13a33c18ef0bd652c1872b6c2ff3c","https://android.googlesource.com/kernel/common/+/18d3876842e1ef0c4fd796aab12fb4a31704830d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500022799.json"}}],"schema_version":"1.9.0"}