CVE-2015-9031: In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP.

Security readout for executives and security teams

This CVE describes a Qualcomm Android kernel issue where HDCP exposes a TrustZone memory address to the normal Android operating system. That is an information leak across a security boundary. The public bundle does not provide severity, CVSS, fixed versions, or active exploitation evidence. Likely exposure is older Qualcomm-based Android devices or firmware derived from CAF Linux kernel releases, especially where OEMs have not incorporated the relevant Android security bulletin fixes. Exact device models and fixed build levels are not provided in the bundle. Prioritize this for legacy Android fleet review, not emergency response, unless affected devices handle sensitive data or lack security updates. The main concern is weakened hardware-backed isolation on Qualcomm Android devices, with incomplete public evidence on exploitability. Mitigation focus: Inventory Qualcomm Android devices and firmware based on CAF Linux kernels.; Check OEM and Android security bulletin guidance for CVE-2015-9031 updates.; Prioritize unsupported Android devices for replacement or isolation..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.