CVE-2026-58828
Received Received - Intake

Use-After-Free in Android Base Component Due to Race Condition

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-58828

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Google Android Android kernel

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Use-After-Free (UAF) vulnerability caused by a race condition in the Linux kernel's DMA-BUF subsystem. The issue occurs in per-process dmabuf accounting procfs files that read a task's dmabuf_info struct to display memory usage (RSS/PSS). These functions did not hold a reference to the struct, allowing it to be freed during operations like exec(), leading to a UAF condition.

Detection Guidance

This vulnerability is a Use-After-Free (UAF) in the Linux kernel's DMA-BUF subsystem. Detection requires checking kernel versions and patches applied. Use commands like 'uname -a' to check kernel version and 'grep -r "dmabuf_info" /proc/kallsyms' to inspect kernel symbols. Monitor system logs for crashes or memory corruption errors.

Impact Analysis

This vulnerability allows a local attacker to escalate privileges on the affected system. No additional execution privileges or user interaction are required for exploitation. It could enable an attacker to gain higher-level access, potentially leading to full system compromise.

Mitigation Strategies

Apply the latest kernel patches from your vendor that address CVE-2026-58828. Update to a patched Android kernel version. Restrict access to /proc filesystems if possible. Monitor for unusual memory corruption or crashes in DMA-BUF related processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...