Memory corruption when kernel driver attempts to trigger hardware fences.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption when the IOCTL call is interrupted by a signal.
Memory corruption in Kernel while handling GPU operations.
Memory corruption while processing graphics kernel driver request to create DMA fence.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile
Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
Improper handling of sensor HAL structure in absence of sensor can lead to use after free in Snapdragon Auto
Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Crafted Binder Request Causes Heap UAF in MediaServer
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
Memory corruption while processing event close when client process terminates abruptly.
Memory corruption while processing the TESTPATTERNCONFIG escape path.
Memory corruption during sub-system restart while processing clean-up to free up resources.
memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.
Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.
Memory corruption while processing a private escape command in an event trigger.
Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
Memory corruption while processing memory map or unmap IOCTL operations simultaneously.
Memory corruption while calling the NPU driver APIs concurrently.
Memory corruption while processing commands from A2dp sink command queue.
A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check, such as msm_pcm_volume_ctl_put(), which means this freed memory could be used.
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
Memory corruption in DSP Services during a remote call from HLOS to DSP.
A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.
Memory corruption in Graphics while processing user packets for command submission.
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Memory corruption while running VK synchronization with KASAN enabled.
Memory corruption in DSP Service during a remote call from HLOS to DSP.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
Memory corruption in WLAN due to use after free
Memory corruption due to use after free in trusted application environment.
Memory corruption due to use after free in Modem while modem initialization.
Memory corruption while handling IOCTL call from user-space to set latency level.
Memory corruption during concurrent buffer access due to modification of the reference count.
Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.