Memory corruption in HLOS while invoking IOCTL calls from user-space.
Memory corruption in HLOS while running playready use-case.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Memory corruption in Automotive Display while destroying the image handle created using connected display driver.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
Memory corruption when processing cmd parameters while parsing vdev.
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
Memory corruption in Core while processing RX intent request.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Memory corruption while processing IOCTL calls to unmap the buffers.
Memory corruption while allocating memory in HGSL driver.
Memory corruption while processing frame command IOCTL calls.
Memory corruption while taking snapshot when an offset variable is set by camera driver.
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
Memory Corruption in WLAN HOST while fetching TX status information.
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
Memory Corruption in SPS Application while exporting public key in sorter TA.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Memory corruption in TZ Secure OS while loading an app ELF.
Memory corruption while allocating memory in COmxApeDec module in Audio.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in core services when Diag handler receives a command to configure event listeners.
Memory corruption while processing audio effects.
Cryptographic issue in HLOS during key management.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Memory corruption in WLAN HAL while parsing WMI command parameters.
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.