Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
Memory corruption in Automotive Android OS due to improper validation of array index.
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
Memory corruption in core due to stack-based buffer overflow
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
Memory corruption due to improper validation of array index in Audio.
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers.
Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
Memory corruption during session sign renewal request calls in HLOS.
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
Memory corruption when the IOCTL call is interrupted by a signal.
Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.
Memory corruption in Linux Networking due to double free while handling a hyp-assign.
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
Memory corruption when kernel driver attempts to trigger hardware fences.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.
Memory corruption when keymaster operation imports a shared key.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption while allocating memory for graphics.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption when the channel ID passed by user is not validated and further used.
Memory corruption in Kernel while handling GPU operations.
Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics.
Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when size of buffer from previous call is used without validation or re-initialization.
Transient DOS due to reachable assertion in Modem because of invalid network configuration.
Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.
Transient DOS during music playback of ALAC content.
Memory corruption due to improper access control in Qualcomm IPC.
Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.
Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
Memory corruption due to double free in core while initializing the encryption key.
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.