{"id":"PUB-A-161010552","details":"In usb_gadget_giveback_request of core.c, there is a possible use after free out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-161010552","CVE-2021-39792"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2022-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/575a552ac7c6b"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/575a552ac7c6b","target":{"file":"drivers/usb/gadget/function/f_accessory.c","function":"acc_function_unbind"},"deprecated":false,"digest":{"function_hash":"100410976886787197906451013634522742914","length":411},"id":"PUB-A-161010552-0e279616","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/575a552ac7c6b","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"deprecated":false,"digest":{"line_hashes":["92858488608888256670078473141606406054","180875822491025722831554686199663901729","17157550638725447842886934216314682555","255658971149427072573943214365510181568","150652126279476852176193119361296209010","17320356894890537060751883159658643531","16324969859119708472053503461875971972","83196457260844783908370531202291906777","256794204682412864343913883574001711832","180875822491025722831554686199663901729","110329735996145910767545249120163837521","228326681755720983503190651504840756417","250118894154258636393811237955625185243"],"threshold":0.9},"id":"PUB-A-161010552-76ea9a50","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/575a552ac7c6b","target":{"file":"drivers/usb/gadget/function/f_accessory.c","function":"create_bulk_endpoints"},"deprecated":false,"digest":{"function_hash":"241108072870579792262434467224001311540","length":1434},"id":"PUB-A-161010552-8e087dff"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/575a552ac7c6b","target":{"file":"drivers/usb/gadget/function/f_accessory.c","function":"acc_read"},"deprecated":false,"digest":{"length":1523,"function_hash":"237090920825579070897266722571206435477"},"id":"PUB-A-161010552-c06d3503","signature_type":"Function"}],"fixes":["https://android.googlesource.com/kernel/common/+/575a552ac7c6b"],"severity":"Moderate","spl":"2022-03-05","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-161010552.json"}}],"schema_version":"1.9.0"}