CVE-2021-4441

What it actually does

NULL pointer dereference in zynq_qspi_exec_mem_op() when kzalloc() fails and the result is passed directly to memset() without a prior NULL check.

Why it matters to the business

May cause kernel crashes or denial-of-service on affected Android devices using the Zynq QSPI controller; low real-world risk given static-analysis origin and low EPSS, but still requires patching to eliminate the latent defect.

How an attack unfolds

An attacker with local kernel code execution or the ability to induce memory pressure would attempt to trigger kzalloc() failure inside zynq_qspi_exec_mem_op() so that the subsequent memset() dereferences a NULL pointer, resulting in a kernel panic; no public exploits or threat-actor campaigns are known.

How to fix it

Update to the fixed Android releases: frameworks/av 10 (2022-04-01), 11 (2022-04-01), 12 (2022-04-01), or 12L (2022-04-01). Rebuild kernels with CONFIG_SPI_ZYNQ_QSPI=m and verify the added tmpbuf NULL check is present.

How to confirm the fix worked

Confirm the presence of the tmpbuf NULL-pointer check after kzalloc() in zynq_qspi_exec_mem_op(); run static-analysis tools or kernel build tests to ensure no new warnings are emitted; verify the device no longer exhibits the defect under memory-pressure fuzzing.

Typical attack path

1. Obtain local execution context or memory-pressure primitive on the target device
2. Force kzalloc() to fail inside zynq_qspi_exec_mem_op()
3. Trigger the unchecked memset() on the NULL buffer
4. Cause kernel oops or panic

How to detect it

Search kernel logs for oops/panic messages referencing zynq_qspi_exec_mem_op() or NULL dereference near kzalloc/memset; review crash dumps for stack traces containing spi-zynq-qspi; correlate with any local memory-exhaustion events.

• zynq_qspi_exec_mem_op
• NULL pointer dereference.*kzalloc
• spi-zynq-qspi

What your security team should do

• Apply the 2022-04-01 Android security patches to all devices running affected frameworks/av branches
• Prioritize devices that expose the Zynq QSPI controller in production firmware
• Monitor vendor update channels for any later backports or additional hardening