arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to obtain sensitive information from kernel memory via a crafted offset, aka Android internal bug 28598347 and Qualcomm internal bug CR548679.
https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=0b5f49b360afdebf8ef55df1e48ec141b3629621