CVE-2017-10998: In all Qualcomm products with Android releases from CAF using the Linux kernel, in audio_aio_ion_lookup_vad...

Security readout for executives and security teams

This flaw affects Qualcomm-based Android builds from CAF using the Linux kernel. A user-controlled buffer length could overflow an address calculation, making a range check unreliable. The public bundle does not provide CVSS, confirmed impact, or exploitation evidence, so urgency depends on whether your device fleet includes affected Qualcomm Android CAF kernels. Exposure is most likely in Android devices or products using Qualcomm components with CAF-derived Linux kernels from the affected era. The source bundle does not identify specific OEM models, chipset families, Android versions, or CPEs. Treat this as an exposure-mapping issue unless affected, unpatched Qualcomm Android devices are present. If such devices remain in production and lack OEM updates, prioritize replacement or compensating mobile controls because the public data does not prove a safe generic workaround. Mitigation focus: Check OEM and Android security guidance for the September 2017 Android bulletin.; Apply available OEM or carrier security updates for affected Qualcomm Android devices.; Prioritize managed devices that run CAF-derived Qualcomm Android kernels..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.