Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption while parsing the memory map info in IOCTL calls.
Information disclosure during audio playback.
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesnt validate the IPC message received from the firmware.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
Transient DOS in Data modem while handling TLB control messages from the Network.
Transient DOS in Modem after RRC Setup message is received.
Memory corruption while sending SMS from AP firmware.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Memory corruption while using the UIM diag command to get the operators name.
Memory corruption in HLOS while invoking IOCTL calls from user-space.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Memory Corruption in Audio while invoking callback function in driver from ADSP.
Memory corruption in Audio while processing the VOC packet data from ADSP.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Cryptographic issue in Data Modem due to improper authentication during TLS handshake.
Transient DOS in WLAN Firmware while parsing rsn ies.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Memory corruption due to improper validation of array index in WLAN HAL when received lmitemNum is out of range.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
Memory corruption in Linux while sending DRM request.