Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Transient DOS in Audio when invoking callback function of ASM driver.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Information disclosure when VI calibration state set by ADSP is greater than MAXFBSPSTATE in the response payload to AFE calibration command.
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Memory corruption when more scan frequency list or channels are sent from the user space.
Information disclosure while parsing sub-IE length during new IE generation.
Information Disclosure while parsing beacon frame in STA.
Information disclosure while handling SA query action frame.
INformation disclosure while handling Multi-link IE in beacon frame.
Information disclosure while handling beacon or probe response frame in STA.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Possible out of bound access in audio module due to lack of validation of user provided input.
Memory Corruption while accessing metadata in Display.
Memory corruption in Audio while validating and mapping metadata.
Memory corruption in Audio during playback session with audio effects enabled.
Information disclosure in Automotive multimedia due to buffer over-read.
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.