CVE-2023-28577 (fastconnect_6800_firmware, fastconnect_6900_firmware, fastconnect_7800_firmware, qca6391_firmware, qca6426_firmware, qca6436_firmware, qcn9074_firmware, qcs410_firmware, qcs610_firmware, sd865_5g_firmware, snapdragon_8_gen_1_firmware,

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

address buffer call called check cve function kernel uaf