The function __vipx_ioctl_put_container() in the Samsung kernel calls copy_to_user() on a vs4l_container_list structure that contains a kernel pointer, exposing that kernel pointer to userspace just before it gets passed to kfree().
cf04790c8d0e642b1910122bf8fab8586f7ff1ad7f3556e2103975c6e9559788