DescriptionIn function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check, such as msm_pcm_volume_ctl_put(), which means this freed memory could be used.
NVD severitymedium (attack range: local)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie3.16.56-1+deb8u1fixed
jessie (security)3.16.68-2fixed
stretch (security)4.9.168-1+deb9u3fixed
buster, sid4.19.37-5fixed


PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)(not affected)


- linux <not-affected> (Android-specific patch)

Search for package or bug name: Reporting problems