Memory corruption while processing specific files in Powerline Communication Firmware.
Memory corruption while processing commands from A2dp sink command queue.
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
Memory corruption may occur while processing the OIS packet parser.
Memory corruption while processing I2C settings in Camera driver.
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
Memory corruption during GNSS HAL process initialization.
Memory corruption while processing GPU page table switch.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while processing GPU commands.
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Memory corruption while handling session errors from firmware.
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
Memory corruption during the network scan request.
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Memory corruption while allocating memory in HGSL driver.
Memory corruption while processing IOCTL call to set metainfo.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption when kernel driver attempts to trigger hardware fences.
Memory corruption while processing graphics kernel driver request to create DMA fence.
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
Memory corruption during session sign renewal request calls in HLOS.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Transient DOS during music playback of ALAC content.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Information disclosure while handling beacon or probe response frame in STA.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.