{"id":"ASB-A-514745329","details":"In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-514745329","CVE-2026-58985"],"modified":"2026-11-02T17:11:12.190721100Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"target":{"file":"libs/binder/include/binder/RpcServer.h"},"deprecated":false,"digest":{"line_hashes":["325418093315597050185588787419573451861","118447729434934649182416740092151683507","169964899884083517509248243314945108012","34601429263827609268043056956872869968"],"threshold":0.9},"id":"ASB-A-514745329-0b68407d","match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e"},{"id":"ASB-A-514745329-2f08e702","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"file":"libs/binder/RpcSession.cpp"},"deprecated":false,"digest":{"line_hashes":["160318620370089547091656989526883584705","306656578026064346377162498907125058868","106196993027315081445079653102663905710","86000905799217755811177415477396899841","182306463363826359128165538115316301489","76716931128753752918798910906837440701","194812490474783064897682372090879126911","244927105927849299050944312433887299755","47164754407184939608932029596815149538","188172418735280445927210632917029788790","321515081199778036677502771163397226526","147023106998877109480784037798836405295","6143125810994274763452516627996748791","37221337840827132447572957251773506466","339090333155018648056937345735583373036","779303450846542017689501238367910492","221915178294030951044176646062167776177"],"threshold":0.9}},{"deprecated":false,"digest":{"length":339,"function_hash":"220745399327824557108566903971502042354"},"id":"ASB-A-514745329-b122674c","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp","function":"RpcServerTrusty::handleChannelCleanup"}},{"target":{"file":"libs/binder/RpcSession.cpp","function":"RpcSession::addOutgoingConnection"},"deprecated":false,"digest":{"function_hash":"80235010618170023483659123137963103657","length":483},"id":"ASB-A-514745329-b9d6f82d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e"},{"digest":{"line_hashes":["2602690693896598654820071353821342646","209112979277181566066986095850770088311","138534607363678736182739674695324908365","131362512551207320535991380209170127225","147055476377445878196008379878449294406","251200354608618665343628869520055067564","20203843541672812377649370731096539720","120791622384888411547853703172736977382","285410202692874450087033027365517268495","300184506551392104708180648646232259408","91289743724652560067485787071421072247","27772190699729289577855237266228479995","11572721583465300624083130603941948072","309051846484325168996222234517770821016","169606483864205200399829645654411268248","237443678143905019231378640542252157129","94027533458072500677356976310910219192","94027533458072500677356976310910219192","18875876403435054284961036060737452833","225524233870238000925242267501778675118","183783837437157205326293055416546964181","172632642273919690393835312515705560716","28329220550957932451198063825544452770","290474914431411914585798291205226767825"],"threshold":0.9},"id":"ASB-A-514745329-bb72e999","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"file":"libs/binder/RpcServer.cpp"},"deprecated":false,"digest":{"line_hashes":["328677694410026104946086264787837698233","197084226930080022592850955142418015921","300139929290678269592681639647826318121","139343356563536984703072284957584095592","158316759580794338381005120304700823891","64152673993155104300952454713619982428","119536901366158043530241054481674326427","186377705989754539474204065217504275744","80857662015494870962479131594026273336","272406148882359970529560952102353951257","257674835596158548266358828557369974403","37382654941522340354261436110645554843","88226416339857126985995427885394904980"],"threshold":0.9},"id":"ASB-A-514745329-bdaa8206","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"file":"libs/binder/trusty/include/binder/RpcServerTrusty.h"},"deprecated":false,"digest":{"line_hashes":["273878674210437934417602070602330267813","61716428665960132741569256855223898298","326475060789664204422586401871302328739","9543864053580854589147504315459479886"],"threshold":0.9},"id":"ASB-A-514745329-d23948f4","signature_type":"Line","signature_version":"v1"},{"match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"file":"libs/binder/include/binder/RpcSession.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["53734488833367912354109056267001367449","19474075900629343993967111447790127432","54685299793862979708674155656203434502","84060781445117946564564625550515397576","182766586154881216192105087611521277528","216773350757917889801756615803524114431","271233895209511156991196788744388949170","299025927355930700626025452241239945812","28622143111185373257613477859799102876","25761713523948121672857945783485935031","136573464687212419425894884588221941064"]},"id":"ASB-A-514745329-dd851734"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e","target":{"function":"RpcServerTrusty::handleConnectInternal","file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false,"digest":{"length":1173,"function_hash":"310963165716737363396101621461446552197"},"id":"ASB-A-514745329-e5d29d6c","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514745329.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false,"digest":{"line_hashes":["2602690693896598654820071353821342646","209112979277181566066986095850770088311","138534607363678736182739674695324908365","131362512551207320535991380209170127225","147055476377445878196008379878449294406","251200354608618665343628869520055067564","20203843541672812377649370731096539720","120791622384888411547853703172736977382","285410202692874450087033027365517268495","300184506551392104708180648646232259408","91289743724652560067485787071421072247","27772190699729289577855237266228479995","11572721583465300624083130603941948072","309051846484325168996222234517770821016","169606483864205200399829645654411268248","237443678143905019231378640542252157129","94027533458072500677356976310910219192","94027533458072500677356976310910219192","18875876403435054284961036060737452833","225524233870238000925242267501778675118","183783837437157205326293055416546964181","172632642273919690393835312515705560716","28329220550957932451198063825544452770","290474914431411914585798291205226767825"],"threshold":0.9},"id":"ASB-A-514745329-042d51d9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48"},{"id":"ASB-A-514745329-1a1328c9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"function":"RpcServerTrusty::handleConnectInternal","file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false,"digest":{"function_hash":"310963165716737363396101621461446552197","length":1173}},{"source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"file":"libs/binder/RpcSession.cpp"},"deprecated":false,"digest":{"line_hashes":["160318620370089547091656989526883584705","306656578026064346377162498907125058868","106196993027315081445079653102663905710","86000905799217755811177415477396899841","182306463363826359128165538115316301489","76716931128753752918798910906837440701","194812490474783064897682372090879126911","244927105927849299050944312433887299755","47164754407184939608932029596815149538","188172418735280445927210632917029788790","294003716432292918104080438101113678599","30796829010423977547645512996481285023","176239844454768304825829774334789385709","275723464973640835139513951805523197702","302961846046410246192412890536546644792","339090333155018648056937345735583373036","779303450846542017689501238367910492","221915178294030951044176646062167776177"],"threshold":0.9},"id":"ASB-A-514745329-32a19949","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1"},{"target":{"function":"RpcSession::addOutgoingConnection","file":"libs/binder/RpcSession.cpp"},"deprecated":false,"digest":{"function_hash":"156777688215780974847367472905022958762","length":517},"id":"ASB-A-514745329-993ea6f9","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48"},{"deprecated":false,"digest":{"line_hashes":["273878674210437934417602070602330267813","61716428665960132741569256855223898298","326475060789664204422586401871302328739","9543864053580854589147504315459479886"],"threshold":0.9},"id":"ASB-A-514745329-a04d20e1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"file":"libs/binder/trusty/include/binder/RpcServerTrusty.h"}},{"source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"file":"libs/binder/include/binder/RpcSession.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["53734488833367912354109056267001367449","19474075900629343993967111447790127432","54685299793862979708674155656203434502","84060781445117946564564625550515397576","182766586154881216192105087611521277528","216773350757917889801756615803524114431","271233895209511156991196788744388949170","299025927355930700626025452241239945812","28622143111185373257613477859799102876","25761713523948121672857945783485935031","136573464687212419425894884588221941064"]},"id":"ASB-A-514745329-ca59a27f","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"220745399327824557108566903971502042354","length":339},"id":"ASB-A-514745329-d3e51d99","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"function":"RpcServerTrusty::handleChannelCleanup","file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"file":"libs/binder/RpcServer.cpp"},"deprecated":false,"digest":{"line_hashes":["328677694410026104946086264787837698233","197084226930080022592850955142418015921","300139929290678269592681639647826318121","139343356563536984703072284957584095592","158316759580794338381005120304700823891","64152673993155104300952454713619982428","119536901366158043530241054481674326427","186377705989754539474204065217504275744","80857662015494870962479131594026273336","272406148882359970529560952102353951257","257674835596158548266358828557369974403","37382654941522340354261436110645554843","88226416339857126985995427885394904980"],"threshold":0.9},"id":"ASB-A-514745329-e472536f"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48","target":{"file":"libs/binder/include/binder/RpcServer.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["325418093315597050185588787419573451861","118447729434934649182416740092151683507","169964899884083517509248243314945108012","34601429263827609268043056956872869968"]},"id":"ASB-A-514745329-f3fb8af5","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514745329.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"file":"libs/binder/include/binder/RpcSession.h"},"deprecated":false,"digest":{"line_hashes":["53734488833367912354109056267001367449","19474075900629343993967111447790127432","54685299793862979708674155656203434502","84060781445117946564564625550515397576","182766586154881216192105087611521277528","216773350757917889801756615803524114431","271233895209511156991196788744388949170","299025927355930700626025452241239945812","28622143111185373257613477859799102876","25761713523948121672857945783485935031","136573464687212419425894884588221941064"],"threshold":0.9},"id":"ASB-A-514745329-1fb13910"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"file":"libs/binder/RpcSession.cpp","function":"RpcSession::addOutgoingConnection"},"deprecated":false,"digest":{"function_hash":"80235010618170023483659123137963103657","length":483},"id":"ASB-A-514745329-2059a482"},{"digest":{"line_hashes":["273878674210437934417602070602330267813","61716428665960132741569256855223898298","326475060789664204422586401871302328739","9543864053580854589147504315459479886"],"threshold":0.9},"id":"ASB-A-514745329-29f93692","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"file":"libs/binder/trusty/include/binder/RpcServerTrusty.h"},"deprecated":false},{"target":{"file":"libs/binder/RpcSession.cpp"},"deprecated":false,"digest":{"line_hashes":["160318620370089547091656989526883584705","306656578026064346377162498907125058868","106196993027315081445079653102663905710","86000905799217755811177415477396899841","182306463363826359128165538115316301489","76716931128753752918798910906837440701","194812490474783064897682372090879126911","244927105927849299050944312433887299755","47164754407184939608932029596815149538","188172418735280445927210632917029788790","321515081199778036677502771163397226526","147023106998877109480784037798836405295","6143125810994274763452516627996748791","37221337840827132447572957251773506466","339090333155018648056937345735583373036","779303450846542017689501238367910492","221915178294030951044176646062167776177"],"threshold":0.9},"id":"ASB-A-514745329-2d88c9c5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1"},{"digest":{"line_hashes":["328677694410026104946086264787837698233","197084226930080022592850955142418015921","300139929290678269592681639647826318121","139343356563536984703072284957584095592","158316759580794338381005120304700823891","64152673993155104300952454713619982428","119536901366158043530241054481674326427","186377705989754539474204065217504275744","80857662015494870962479131594026273336","272406148882359970529560952102353951257","257674835596158548266358828557369974403","37382654941522340354261436110645554843","88226416339857126985995427885394904980"],"threshold":0.9},"id":"ASB-A-514745329-5312e6e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"file":"libs/binder/RpcServer.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["2602690693896598654820071353821342646","209112979277181566066986095850770088311","138534607363678736182739674695324908365","131362512551207320535991380209170127225","147055476377445878196008379878449294406","251200354608618665343628869520055067564","20203843541672812377649370731096539720","120791622384888411547853703172736977382","285410202692874450087033027365517268495","300184506551392104708180648646232259408","91289743724652560067485787071421072247","27772190699729289577855237266228479995","11572721583465300624083130603941948072","309051846484325168996222234517770821016","169606483864205200399829645654411268248","237443678143905019231378640542252157129","94027533458072500677356976310910219192","94027533458072500677356976310910219192","18875876403435054284961036060737452833","225524233870238000925242267501778675118","183783837437157205326293055416546964181","172632642273919690393835312515705560716","28329220550957932451198063825544452770","290474914431411914585798291205226767825"]},"id":"ASB-A-514745329-731b6b4d","signature_type":"Line","signature_version":"v1"},{"target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp","function":"RpcServerTrusty::handleConnectInternal"},"deprecated":false,"digest":{"function_hash":"310963165716737363396101621461446552197","length":1173},"id":"ASB-A-514745329-7565fda8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1"},{"digest":{"line_hashes":["325418093315597050185588787419573451861","118447729434934649182416740092151683507","169964899884083517509248243314945108012","34601429263827609268043056956872869968"],"threshold":0.9},"id":"ASB-A-514745329-dfa5dbd4","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"file":"libs/binder/include/binder/RpcServer.h"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1","target":{"function":"RpcServerTrusty::handleChannelCleanup","file":"libs/binder/trusty/RpcServerTrusty.cpp"},"deprecated":false,"digest":{"function_hash":"220745399327824557108566903971502042354","length":339},"id":"ASB-A-514745329-f85f01fd","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514745329.json"}}],"schema_version":"1.9.2"}