Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while processing concurrent IOCTL calls.

Memory corruption while handling session errors from firmware.

In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Memory corruption while processing IOCTL calls to unmap the buffers.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

Memory corruption when multiple threads try to unregister the CVP buffer at the same time.

Memory corruption while handling the PDR in driver for getting the remote heap maps.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption while processing frame command IOCTL calls.

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.