{"id":"ASB-A-508702285","details":"In multiple functions of sock.c, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508702285","CVE-2026-53256"],"modified":"2026-11-03T17:44:55.642301420Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["119304148606108425620440520749268973760","114456420057588136829214563551446071301","109753092265637300733483360952299793114","239857816977802249055733047565454650742","39515061866892379177069211544348755438","114100749486237938371200905835892104867","81535646171803311523337324628721926936","114550349818490728001999322351770717428","335632952412772202576072628092425987094","299693517246550718062294192466148883943","25345098154643556846009525995537098514","328875349520424167271909868170753176862","318218412031819257420271960532560371785","194513113760957078398125523911873778353","187548019280731213540436955772254212271","284128772810276791188601080636789077216","209804058756067137627904593084442880692","208798607309109665307419088567308909111","249762910882865787570726701501775891717","185712190580179842891860486597205289511","76071929915527304249894607992807628611","198866531542447259379823044310549319919","21421823350857257870372944673665977128","305764427721473629964608808453175536908"],"threshold":0.9},"id":"ASB-A-508702285-0d96e578","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b","target":{"file":"net/bluetooth/rfcomm/sock.c"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083","target":{"file":"net/bluetooth/rfcomm/sock.c","function":"rfcomm_get_sock_by_channel"},"deprecated":false,"digest":{"length":501,"function_hash":"58419060613801774781814851664564955719"},"id":"ASB-A-508702285-4e22975b","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"6242110563616028922857955664654898619","length":950},"id":"ASB-A-508702285-c61a75bc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b","target":{"function":"rfcomm_connect_ind","file":"net/bluetooth/rfcomm/sock.c"}},{"deprecated":false,"digest":{"line_hashes":["119304148606108425620440520749268973760","114456420057588136829214563551446071301","109753092265637300733483360952299793114","239857816977802249055733047565454650742","39515061866892379177069211544348755438","114100749486237938371200905835892104867","81535646171803311523337324628721926936","114550349818490728001999322351770717428","335632952412772202576072628092425987094","299693517246550718062294192466148883943","25345098154643556846009525995537098514","328875349520424167271909868170753176862","318218412031819257420271960532560371785","194513113760957078398125523911873778353","187548019280731213540436955772254212271","284128772810276791188601080636789077216","209804058756067137627904593084442880692","208798607309109665307419088567308909111","249762910882865787570726701501775891717","185712190580179842891860486597205289511","76071929915527304249894607992807628611","198866531542447259379823044310549319919","21421823350857257870372944673665977128","305764427721473629964608808453175536908"],"threshold":0.9},"id":"ASB-A-508702285-cc480566","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083","target":{"file":"net/bluetooth/rfcomm/sock.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083","target":{"file":"net/bluetooth/rfcomm/sock.c","function":"rfcomm_connect_ind"},"deprecated":false,"digest":{"function_hash":"6242110563616028922857955664654898619","length":950},"id":"ASB-A-508702285-e0614e82"},{"source":"https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b","target":{"file":"net/bluetooth/rfcomm/sock.c","function":"rfcomm_get_sock_by_channel"},"deprecated":false,"digest":{"length":501,"function_hash":"58419060613801774781814851664564955719"},"id":"ASB-A-508702285-fc90bc7f","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/kernel/common/+/529c9d587ac146586f9817ee994bd8cfa609769b","https://android.googlesource.com/kernel/common/+/1542c05a4e0c4d0e76670e356bb5322a7e85b083"],"severity":"Critical","spl":"2026-11-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508702285.json"}}],"schema_version":"1.9.2"}