{"schema_version":"1.9.0","id":"PUB-A-189986136","published":"2021-10-01T00:00:00Z","modified":"2026-09-08T15:39:03.104189951Z","aliases":["A-189986136","CVE-2021-20292"],"details":"In tgm_dma_tt_init of tt.c, there is a possible kernel memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2021-10-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586"],"severity":"Moderate","spl":"2021-10-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["99760196989237430145374562699292576386","229486327248555091480189875678706106603","36806715450090505409748161799330914059","198713342626075603456915605442523295014","10747102013188388065129342667086014925","83120179611697872073312615012807978291","254440493267405285362787797755120615436","198713342626075603456915605442523295014","82742658958636903326583374865980022811","14875190309410894972600801337859108780","8161385380042865390380087488035071785","198713342626075603456915605442523295014"],"threshold":0.9},"id":"PUB-A-189986136-62880204","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","target":{"file":"drivers/gpu/drm/ttm/ttm_tt.c"}},{"deprecated":false,"digest":{"function_hash":"95250431862744492868366196569261966038","length":383},"id":"PUB-A-189986136-6d47fbd6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","target":{"file":"drivers/gpu/drm/ttm/ttm_tt.c","function":"ttm_sg_tt_init"}},{"deprecated":false,"digest":{"line_hashes":["8824410934351240941181826756432675163","133895021803712512708335921558532149274","70979166590252622799742719816518436903","205817275285492178908459014909946591933"],"threshold":0.9},"id":"PUB-A-189986136-a21e1718","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","target":{"file":"drivers/gpu/drm/nouveau/nouveau_sgdma.c"}},{"deprecated":false,"digest":{"function_hash":"320647648374859512842499050818099665047","length":295},"id":"PUB-A-189986136-b7dea2e4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","target":{"file":"drivers/gpu/drm/ttm/ttm_tt.c","function":"ttm_dma_tt_init"}},{"deprecated":false,"digest":{"function_hash":"210051124257186630756131889368541505965","length":231},"id":"PUB-A-189986136-bcd2316d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","target":{"file":"drivers/gpu/drm/ttm/ttm_tt.c","function":"ttm_tt_init"}},{"deprecated":false,"digest":{"function_hash":"241039919280530111255542101175963279308","length":453},"id":"PUB-A-189986136-c13d3003","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","target":{"file":"drivers/gpu/drm/nouveau/nouveau_sgdma.c","function":"nouveau_sgdma_create_ttm"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-189986136.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-10-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586"}]}