Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
Memory corruption when processing cmd parameters while parsing vdev.
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
Memory corruption in Core while processing RX intent request.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Memory corruption while processing IOCTL calls to unmap the buffers.
Memory corruption while allocating memory in HGSL driver.
Memory corruption while processing frame command IOCTL calls.
Memory corruption while taking snapshot when an offset variable is set by camera driver.
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
Memory Corruption in WLAN HOST while fetching TX status information.
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
Memory Corruption in SPS Application while exporting public key in sorter TA.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Memory corruption in TZ Secure OS while loading an app ELF.
Memory corruption while allocating memory in COmxApeDec module in Audio.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in core services when Diag handler receives a command to configure event listeners.
Memory corruption while processing audio effects.
Cryptographic issue in HLOS during key management.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Memory corruption in WLAN HAL while parsing WMI command parameters.
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Memory Corruption in HLOS while registering for key provisioning notify.
Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.