kernel event may contain unexpected content which is not generated by NPU software in asynchronous execution mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile
Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Memory corruption in Core due to improper configuration in boot remapper.
Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto
Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in graphic driver due to use after free while calling multiple threads application to driver. in Snapdragon Consumer IOT
Memory corruption in audio due to lack of check of invalid routing address into APR Routing table in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption while processing IOCTL handler in FastRPC.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption while processing TPC target power table in FTM TPC.
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption when multiple listeners are being registered with the same file descriptor.
Memory corruption when malformed message payload is received from firmware.
Memory corruption while maintaining memory maps of HLOS memory.
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
Memory corruption while handling file descriptor during listener registration/de-registration.
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Memory corruption while parsing the ADSP response command.
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
Memory corruption in DSP Services during a remote call from HLOS to DSP.
Memory corruption in Graphics while processing user packets for command submission.
Memory corruption while running VK synchronization with KASAN enabled.
Memory corruption in DSP Service during a remote call from HLOS to DSP.
Memory corruption in Audio while processing the VOC packet data from ADSP.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory Corruption in Audio while invoking callback function in driver from ADSP.
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
Memory corruption in HLOS while running playready use-case.
Memory corruption in Audio during playback with speaker protection.
Memory corruption in Automotive Display while destroying the image handle created using connected display driver.
Memory corruption while receiving a message in Bus Socket Transport Server.
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.