{"id":"ASB-A-510777270","details":"In multiple locations, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-510777270","CVE-2026-43284"],"modified":"2026-11-06T16:30:33.305097686Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/32b16e61d1a02c4554d48b544ea4739d12e450e7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/055c84c410288cf5169e180f8aca0792b6b8c9de"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/core/skbuff.c","function":"skb_shift"},"deprecated":false,"digest":{"length":2158,"function_hash":"91742733428788130397965204293108171244"},"id":"ASB-A-510777270-06f2fbc9","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"function":"skb_segment","file":"net/core/skbuff.c"},"deprecated":false,"digest":{"function_hash":"319856442849024638003504312862304246647","length":5964},"id":"ASB-A-510777270-0c863b6a","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/core/skbuff.c","function":"__pskb_copy_fclone"},"deprecated":false,"digest":{"length":1042,"function_hash":"280867113296349441708551663015315042137"},"id":"ASB-A-510777270-0dcf6d63","signature_type":"Function"},{"target":{"file":"net/core/skbuff.c","function":"__pskb_copy_fclone"},"deprecated":false,"digest":{"function_hash":"280867113296349441708551663015315042137","length":1042},"id":"ASB-A-510777270-147f007b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d"},{"digest":{"line_hashes":["312881643177826280777830297044347504768","297846943928482041375948823317799282383","285743020579598522495409899793644455257","90538739864380090038366245362115199228","324360749300625992716500536097904881082","190416525755408548172885947640085701606","338350720209766154941851486207549619534","218426955400649711511664834721023917489","160932596683480856539897854816098598170","339536572689343542328215863006768141239","152536960485818613522586827230375834995","199634962422568380063236981001517002603","8382474956000402941024382491797402559","322684015240767507523435753370583460076","336777174111468257512648731284958139213"],"threshold":0.9},"id":"ASB-A-510777270-1f118712","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/core/skbuff.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","target":{"file":"net/core/skbuff.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["312881643177826280777830297044347504768","297846943928482041375948823317799282383","285743020579598522495409899793644455257","90538739864380090038366245362115199228","324360749300625992716500536097904881082","190416525755408548172885947640085701606","338350720209766154941851486207549619534","218426955400649711511664834721023917489","160932596683480856539897854816098598170","339536572689343542328215863006768141239","152536960485818613522586827230375834995","199634962422568380063236981001517002603","8382474956000402941024382491797402559","322684015240767507523435753370583460076","336777174111468257512648731284958139213"]},"id":"ASB-A-510777270-22bbff85"},{"id":"ASB-A-510777270-2965f2c9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","target":{"file":"net/ipv4/tcp_output.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["284551892310142972892462443899426368952","107230980890878505977582831301549243582","332930435860706616423229368963062467612","81177134186905337338397903792156864869"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/core/gro.c","function":"skb_gro_receive_list"},"deprecated":false,"digest":{"function_hash":"290437696452964944089008959090018522447","length":580},"id":"ASB-A-510777270-4885d06a"},{"source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/core/gro.c","function":"skb_gro_receive"},"deprecated":false,"digest":{"function_hash":"243613004856564571972376881901091222768","length":2802},"id":"ASB-A-510777270-51144b47","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","target":{"file":"net/core/skbuff.c","function":"skb_segment"},"deprecated":false,"digest":{"length":5965,"function_hash":"285931845256607974888125062127953898479"},"id":"ASB-A-510777270-56047f4a","signature_type":"Function"},{"digest":{"length":2802,"function_hash":"243613004856564571972376881901091222768"},"id":"ASB-A-510777270-6efbfdd3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","target":{"file":"net/core/gro.c","function":"skb_gro_receive"},"deprecated":false},{"target":{"function":"skb_shift","file":"net/core/skbuff.c"},"deprecated":false,"digest":{"function_hash":"227739965523775833213645733882847545764","length":2067},"id":"ASB-A-510777270-8682ccba","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d"},{"source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/core/gro.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56185576558040875368284456804077943380","318782309485420706209309296235445509879","227611995469135165587549726479859741839","73080700397866984672625131147371022088","247709252813333293106021914147493333691","100933641374056081934403260978026728600","147155615285117421597739311656427839954","97420916760095354680843254574730468679","227952949834520182169332113779308920045","283566494111398482778146177706738809207","75387441328425519908524765887164045313"]},"id":"ASB-A-510777270-8a1ab4ff","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":1142,"function_hash":"45472403817046738367471062135241862215"},"id":"ASB-A-510777270-91a3ec48","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","target":{"file":"net/ipv4/tcp_output.c","function":"tcp_clone_payload"}},{"source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/ipv4/tcp_output.c"},"deprecated":false,"digest":{"line_hashes":["284551892310142972892462443899426368952","107230980890878505977582831301549243582","332930435860706616423229368963062467612","81177134186905337338397903792156864869"],"threshold":0.9},"id":"ASB-A-510777270-ceb96dad","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-510777270-e53cc8eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","target":{"file":"net/ipv4/tcp_output.c","function":"tcp_clone_payload"},"deprecated":false,"digest":{"function_hash":"45472403817046738367471062135241862215","length":1142}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","target":{"file":"net/core/gro.c"},"deprecated":false,"digest":{"line_hashes":["56185576558040875368284456804077943380","318782309485420706209309296235445509879","227611995469135165587549726479859741839","73080700397866984672625131147371022088","247709252813333293106021914147493333691","100933641374056081934403260978026728600","147155615285117421597739311656427839954","97420916760095354680843254574730468679","124729368298976677326944785488206199926","54147940626994910768661334849157025106","39379825384269018709475356749774132187","158061157999566435289656919733204680211"],"threshold":0.9},"id":"ASB-A-510777270-f151f101","signature_type":"Line"}],"fixes":["https://android.googlesource.com/kernel/common/+/f6d22ea6ae50acbc3f811a14fb2e55a2c129007d","https://android.googlesource.com/kernel/common/+/32b16e61d1a02c4554d48b544ea4739d12e450e7","https://android.googlesource.com/kernel/common/+/c7fb8c4114577c9f5b34a82259f3d7b8addbacb1","https://android.googlesource.com/kernel/common/+/055c84c410288cf5169e180f8aca0792b6b8c9de"],"severity":"High","spl":"2026-11-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-510777270.json"}}],"schema_version":"1.9.2"}