CVE-2022-48880

What it actually does

Missing call to ssam_request_sync_free() after ssam_request_sync_init() failure in the surface aggregator causes the allocated request object to be leaked.

Why it matters to the business

Repeated initialization failures can gradually exhaust kernel memory on affected Linux-based systems and Android devices, leading to performance degradation or crashes in long-running environments.

How an attack unfolds

An attacker would need to trigger the rare failure path in ssam_request_sync_init() repeatedly; no public exploits or threat actor campaigns are associated with this issue.

How to fix it

Apply the upstream fix commit d2dc110deabe7142b60ebeed689e67f92795ee24 or later; for Android update platform/frameworks/av and platform/hardware/interfaces to the 2021-04-01 security patch level or newer corresponding branches (8.1/9/10/11).

How to confirm the fix worked

Inspect the aggregator request handling code to confirm the free call exists after the init failure branch; verify running kernel contains the referenced commit or equivalent backport.

Typical attack path

1. Trigger conditions that cause ssam_request_sync_init() to fail
2. Observe that ssam_request_sync_free() is never invoked
3. Accumulate leaked request structures until memory pressure occurs

How to detect it

No known active exploitation; review kernel logs for repeated surface aggregator init failures combined with memory pressure indicators on affected hardware.

What your security team should do

• Prioritize patching Linux kernel and Android devices to the listed fixed versions
• Monitor memory usage on surface-aggregator enabled systems for unexplained growth
• Include the fix in the next standard kernel and firmware update cycle