{"id":"ASB-A-533808379","details":"In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-533808379","CVE-2026-64560"],"modified":"2026-11-03T17:44:55.642301420Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"target":{"file":"kernel/time/posix-cpu-timers.c","function":"posix_cpu_timer_del"},"deprecated":false,"digest":{"length":531,"function_hash":"123653562287265820786466611231280258670"},"id":"ASB-A-533808379-12149a88","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4"},{"source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"file":"kernel/exit.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43114588019524924526989266788798388833","228723880276375800625945384579402475220","175533836729769612315445994251456468189","14112774109510243263818320448867868721"]},"id":"ASB-A-533808379-281260a4","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":355,"function_hash":"137247482359916170051141939040158303454"},"id":"ASB-A-533808379-35b142bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4","target":{"file":"kernel/signal.c","function":"__lock_task_sighand"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"file":"kernel/time/posix-cpu-timers.c","function":"posix_cpu_timer_del"},"deprecated":false,"digest":{"function_hash":"123653562287265820786466611231280258670","length":531},"id":"ASB-A-533808379-70f286b0","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"file":"kernel/signal.c"},"deprecated":false,"digest":{"line_hashes":["149941632552429856152591311313365714987","279388328007323953588683632076381230591","272856991738826480344432415864588005738","253125967125798295880417158431049584262","228621781963876772151596789014714937132"],"threshold":0.9},"id":"ASB-A-533808379-7af73118","signature_type":"Line"},{"target":{"file":"kernel/exit.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43114588019524924526989266788798388833","228723880276375800625945384579402475220","175533836729769612315445994251456468189","14112774109510243263818320448867868721"]},"id":"ASB-A-533808379-824d1fcb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4"},{"source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4","target":{"file":"kernel/time/posix-cpu-timers.c"},"deprecated":false,"digest":{"line_hashes":["324243107520936070687765475268536307696","268347776245837878919206023386784763950","303678981118062518404972624620342862303","199073437246989927214916245684242630617","1687849992115900370266969808527387471","298737563853513830451560910386108234053","19245078002677905472440060901662239080","205377334666937879465523225676825578848","339413903058947969944737583601375195385","178392315473201305866504516684689401545","106149499730360214509305843099925179061","89100169802706140731633861472595977166","164598207134543419145712904859953124534","152685215247703253800513326388061087902","224653171555661878216588299163320144822","271001194193364755494294991824707129422","334992214003272341009983295572463271399","242478185876372949876066247313438326217","248538265346563444354989994783938161214","150679824179303283072829324438917752746","148756891936156234040708335394183838855","12658126624592149754324092506737527792","280704840908517482760122202732283784635","192263024971447619735405586221485486724","29350548663008711827056075951701964861","241288640051571829033499659213802901568","157101320479031314223853432357588203365","298737563853513830451560910386108234053","19245078002677905472440060901662239080","205377334666937879465523225676825578848","339413903058947969944737583601375195385","119939941493895926735414551868411148432","326616882032127684779829859914288072691","154939779382675117560091869428686626271","154947002456614522488157300424401648940","30173311800743245980225054761187882561","251646686894873893245611025394784268448","252103638247317224476503973665464308969","216662551416443330335700807613961228476","310459625445063454644132678514820963842","31692797687529993609347869218191569390","338288214296269795661465762279202277403","185020165765306317116351928650986195815","89515021375029848963354352382916143108","91057795080712421023482359182938543312","4979415748125005638418353392428608426","146757618273911150694287499756404433487","289086470073956453317619668412327282788","55548635884891058780738186657310634787","82628622357371030498986950834354750749","304718398240519042067171032677377216657","312000716194261700987173596297726867276","147759237623837845778794718915987797742","216730459540491471322891858408142801108","81961143379971827628611080235122972104","165772529597206597662868299748843562020","309992297679148584480319776612594467287","98666742321325489565332941396143999366","22073565362314521081855754428228627489","330123522891332443291055784795896640786","170951582768747585953691298958757905044","270390396800326209564243775083555401409","79600558126079177591989217047758316540","283159291610026157924141972106940564926","250228787412424376679471174458642956084","41187403167623016111532229434765079181","53987128708001408757438242758118719903","41446953492264727938848750899228081588","134830002413597896615237303108020320611","104471826456038085160752516229698115999","152536017818035785344726997698494032971","150679824179303283072829324438917752746","2765887644849914581356182073488238906","3631278316946752932570190483418331706","66709614813684427535314430343464648453","147095014628076201774578141384118571049","93377537123392861111467898784801096251","50973984736266259223614843310531861149","322894803993027285840830642786544189345","108617322520608545007248412163548998881","122863963647947374213999122650752011415","21941844526351832891815325825560766215","269705575031536042264572647060933496230","166710447985182769115863201910176491026","106149499730360214509305843099925179061","89100169802706140731633861472595977166","127917389040037399563073382462993140722","274555175857124559605474771983225507820","117355604941234336507230086848493947256","233065423273981369594785573053630429803","33033824758439397338906463759894198140","141968144502346515219785007825482827749","330819593899507894458845968429296150765","30848131153742286084401562982421929426","308564604525847688672797322506773564218","43450817236585217659631878009222617028"],"threshold":0.9},"id":"ASB-A-533808379-8f832758","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":355,"function_hash":"137247482359916170051141939040158303454"},"id":"ASB-A-533808379-b1f91057","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"file":"kernel/signal.c","function":"__lock_task_sighand"}},{"source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"file":"kernel/time/posix-cpu-timers.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["324243107520936070687765475268536307696","268347776245837878919206023386784763950","303678981118062518404972624620342862303","199073437246989927214916245684242630617","1687849992115900370266969808527387471","298737563853513830451560910386108234053","19245078002677905472440060901662239080","205377334666937879465523225676825578848","339413903058947969944737583601375195385","178392315473201305866504516684689401545","106149499730360214509305843099925179061","89100169802706140731633861472595977166","164598207134543419145712904859953124534","152685215247703253800513326388061087902","224653171555661878216588299163320144822","271001194193364755494294991824707129422","334992214003272341009983295572463271399","242478185876372949876066247313438326217","248538265346563444354989994783938161214","150679824179303283072829324438917752746","148756891936156234040708335394183838855","12658126624592149754324092506737527792","280704840908517482760122202732283784635","192263024971447619735405586221485486724","29350548663008711827056075951701964861","156525215759013689317128499691611151178","216749289074039913082979358020014375529","252171431420801449694938499899194725054","19245078002677905472440060901662239080","205377334666937879465523225676825578848","339413903058947969944737583601375195385","119939941493895926735414551868411148432","326616882032127684779829859914288072691","154939779382675117560091869428686626271","154947002456614522488157300424401648940","30173311800743245980225054761187882561","251646686894873893245611025394784268448","252103638247317224476503973665464308969","216662551416443330335700807613961228476","310459625445063454644132678514820963842","31692797687529993609347869218191569390","160235025493294788274410399779854591978","103524996572791825911924027063019655488","8930130676006828483559122377766831952","55548635884891058780738186657310634787","82628622357371030498986950834354750749","221851050294052885345319879717283308929","235218780496809334130815441857952397297","19577288630110716668797227003816795355","289730302734461431177569180921036387321","231347635987885555335154039414287844291","177248875989916298676270152345390005624","196015176377735789602224040673685962111","322894803993027285840830642786544189345","108617322520608545007248412163548998881","122863963647947374213999122650752011415","21941844526351832891815325825560766215","269705575031536042264572647060933496230","166710447985182769115863201910176491026","106149499730360214509305843099925179061","89100169802706140731633861472595977166","127917389040037399563073382462993140722","274555175857124559605474771983225507820","117355604941234336507230086848493947256","233065423273981369594785573053630429803","33033824758439397338906463759894198140","141968144502346515219785007825482827749","330819593899507894458845968429296150765","30848131153742286084401562982421929426","308564604525847688672797322506773564218","43450817236585217659631878009222617028"]},"id":"ASB-A-533808379-d1959f80","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"function":"posix_cpu_timer_rearm","file":"kernel/time/posix-cpu-timers.c"},"deprecated":false,"digest":{"length":505,"function_hash":"262239292286114736391504406723550354151"},"id":"ASB-A-533808379-d280b0dc","signature_type":"Function"},{"source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4","target":{"function":"__exit_signal","file":"kernel/exit.c"},"deprecated":false,"digest":{"function_hash":"20949003356167785927485037916243630608","length":1435},"id":"ASB-A-533808379-d5f759c0","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4","target":{"function":"posix_cpu_timer_rearm","file":"kernel/time/posix-cpu-timers.c"},"deprecated":false,"digest":{"function_hash":"262239292286114736391504406723550354151","length":505},"id":"ASB-A-533808379-dce4563a","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"20949003356167785927485037916243630608","length":1435},"id":"ASB-A-533808379-f21d1bda","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc","target":{"file":"kernel/exit.c","function":"__exit_signal"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4","target":{"file":"kernel/signal.c"},"deprecated":false,"digest":{"line_hashes":["149941632552429856152591311313365714987","279388328007323953588683632076381230591","272856991738826480344432415864588005738","253125967125798295880417158431049584262","228621781963876772151596789014714937132"],"threshold":0.9},"id":"ASB-A-533808379-fd648de4","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/kernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4","https://android.googlesource.com/kernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3cc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-533808379.json"}}],"schema_version":"1.9.2"}