{"id":"ASB-A-508702364","details":"In multiple functions of sco.c, there is a possible use-after-free due to a race condition. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508702364","CVE-2026-89774"],"modified":"2026-11-03T17:44:55.642301420Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/315636ba7cbf03382cfa7bd8887118f59fe96c5f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/84728e305ff666fc2bf2be382b422b51912d7b1c"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"target":{"file":"net/bluetooth/sco.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["273364551645338130697825508727241130297","275908178875978117776352226865614959846","293763659914679669206540731570329294576","157976387003120787858427734019012359638","16923051719742114461656602309514615766","139491148476820057207780320113663748263","290464195320875838348115235392778370203","210330632548212883944608933081380284154","149738300467627174037688796449593648879","163860092760068168527973404496330574299","117652904510319141525138768182563033961","311573751295308132078103560150549670592","90782519114656288674661256744102693445","230744974639091283630199179283443179404","1758954352448707785300830385368890571","257378971991063428663598234511197412995","255842230632903779588210061712097146888","96487420358020009315788618222781474038","71623675858635082092189388405736378796","295223522198145799127549827488787723513","67417721803691219438397107276495800094","256145075084012526286231653295815039809","245609480039668376167631402016154579609","46314266466018278230280954785230977585"]},"id":"ASB-A-508702364-1edeb818","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb","target":{"file":"net/bluetooth/sco.c","function":"sco_conn_ready"},"deprecated":false,"digest":{"length":1024,"function_hash":"98532195768334665285801633892327255544"},"id":"ASB-A-508702364-c8f953a5"},{"digest":{"length":1024,"function_hash":"98532195768334665285801633892327255544"},"id":"ASB-A-508702364-d9ff4b43","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a","target":{"function":"sco_conn_ready","file":"net/bluetooth/sco.c"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb","target":{"file":"net/bluetooth/sco.c"},"deprecated":false,"digest":{"line_hashes":["273364551645338130697825508727241130297","275908178875978117776352226865614959846","293763659914679669206540731570329294576","157976387003120787858427734019012359638","16923051719742114461656602309514615766","139491148476820057207780320113663748263","290464195320875838348115235392778370203","210330632548212883944608933081380284154","149738300467627174037688796449593648879","163860092760068168527973404496330574299","117652904510319141525138768182563033961","311573751295308132078103560150549670592","90782519114656288674661256744102693445","230744974639091283630199179283443179404","1758954352448707785300830385368890571","257378971991063428663598234511197412995","255842230632903779588210061712097146888","96487420358020009315788618222781474038","71623675858635082092189388405736378796","295223522198145799127549827488787723513","67417721803691219438397107276495800094","256145075084012526286231653295815039809","245609480039668376167631402016154579609","46314266466018278230280954785230977585"],"threshold":0.9},"id":"ASB-A-508702364-e29745be","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/kernel/common/+/315636ba7cbf03382cfa7bd8887118f59fe96c5f","https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb","https://android.googlesource.com/kernel/common/+/84728e305ff666fc2bf2be382b422b51912d7b1c","https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508702364.json"}}],"schema_version":"1.9.2"}