{"id":"ASB-A-511263142","details":"In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-511263142","CVE-2026-58990"],"modified":"2026-11-02T17:11:13.841494452Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"id":"ASB-A-511263142-d9c2644a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c2a47d8f70ef96e417ac0aec02a80c5ec5710e3a","target":{"file":"system/stack/l2cap/l2c_fcr.cc","function":"l2c_fcr_process_peer_cfg_req"},"deprecated":false,"digest":{"function_hash":"278481947417331680563942531163900918557","length":2676}},{"target":{"file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"line_hashes":["168556504593283868926714992799695355084","6600388060011762667856770947447871709","286451409060989210914113686422403817087"],"threshold":0.9},"id":"ASB-A-511263142-e3c45946","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c2a47d8f70ef96e417ac0aec02a80c5ec5710e3a"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c2a47d8f70ef96e417ac0aec02a80c5ec5710e3a"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511263142.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c9103006b383b9e6be353c54f2948b6989400d3","target":{"file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["159398918011162506279187512366821457941","337394940854092034711896107288549428702","266855468169604221462535693855786658067"]},"id":"ASB-A-511263142-0dcf8cab"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c9103006b383b9e6be353c54f2948b6989400d3","target":{"file":"system/stack/l2cap/l2c_fcr.cc","function":"l2c_fcr_process_peer_cfg_req"},"deprecated":false,"digest":{"length":2486,"function_hash":"137296520204503045751365786225763141905"},"id":"ASB-A-511263142-6957218b","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c9103006b383b9e6be353c54f2948b6989400d3"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511263142.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["158817495041906510911965844793965412587","37587684898719464044817081512468193961","318440218757037697366016955669440788412"]},"id":"ASB-A-511263142-8ee98641","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a172654cf1ffb8ea1e6c5f843f44de9a4a0eeef","target":{"file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false},{"target":{"function":"l2c_fcr_process_peer_cfg_req","file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"function_hash":"82771970369623959507545372837089915813","length":2517},"id":"ASB-A-511263142-91ec30a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a172654cf1ffb8ea1e6c5f843f44de9a4a0eeef"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a172654cf1ffb8ea1e6c5f843f44de9a4a0eeef"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511263142.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["168556504593283868926714992799695355084","6600388060011762667856770947447871709","286451409060989210914113686422403817087"]},"id":"ASB-A-511263142-3f5cd43d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ebc86d08f2eee64b468fae900311b94656ee7811"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ebc86d08f2eee64b468fae900311b94656ee7811","target":{"file":"system/stack/l2cap/l2c_fcr.cc","function":"l2c_fcr_process_peer_cfg_req"},"deprecated":false,"digest":{"length":2692,"function_hash":"170379592568063900264787715260528658019"},"id":"ASB-A-511263142-68653388","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ebc86d08f2eee64b468fae900311b94656ee7811"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511263142.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33ab2593621afd66257b8ec469f2a2ac2f4ff083","target":{"file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"line_hashes":["168556504593283868926714992799695355084","6600388060011762667856770947447871709","286451409060989210914113686422403817087"],"threshold":0.9},"id":"ASB-A-511263142-83113bd9"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33ab2593621afd66257b8ec469f2a2ac2f4ff083","target":{"file":"system/stack/l2cap/l2c_fcr.cc","function":"l2c_fcr_process_peer_cfg_req"},"deprecated":false,"digest":{"function_hash":"278481947417331680563942531163900918557","length":2676},"id":"ASB-A-511263142-cb91f6c0"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33ab2593621afd66257b8ec469f2a2ac2f4ff083"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511263142.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5346ef0ebd56af28bdc14da0d77b5f43853bf02"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5346ef0ebd56af28bdc14da0d77b5f43853bf02","target":{"file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"line_hashes":["159398918011162506279187512366821457941","337394940854092034711896107288549428702","266855468169604221462535693855786658067"],"threshold":0.9},"id":"ASB-A-511263142-131f9369","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5346ef0ebd56af28bdc14da0d77b5f43853bf02","target":{"function":"l2c_fcr_process_peer_cfg_req","file":"system/stack/l2cap/l2c_fcr.cc"},"deprecated":false,"digest":{"function_hash":"244566742020578064108953421840380359437","length":2388},"id":"ASB-A-511263142-536114a3","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511263142.json"}}],"schema_version":"1.9.2"}