Can dou you name some? I highly doubt that you can buy data from a specific person.

You would need a lot of data and the know how to trace that data back to a specific account/user

Which CVE is that and where can i read a description of how this vulnerability is being used?

They are not legally allowed to build drivers from the illegally acquired source code.