Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
Memory Corruption when accessing buffers with invalid length during TA invocation.
Transient DOS when an LTE RLC packet with invalid TB is received by UE.
Memory corruption while using alignments for memory allocation.
Memory corruption while processing identity credential operations in the trusted application.
Memory corruption while handling buffer mapping operations in the cryptographic driver.
Information disclosure while processing a firmware event.
Transient DOS while parsing video packets received from the video firmware.
Memory corruption while routing GPR packets between user and root when handling large data packet.
Memory corruption while calling the NPU driver APIs concurrently.
Memory corruption while processing command in Glink linux.
Information disclosure while deriving keys for a session for any Widevine use case.
Memory corruption in display driver while detaching a device.
Transient DOS may occur while processing the country IE.
Memory corruption may occur while validating ports and channels in Audio driver.
Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Memory corruption when Alternative Frequency offset value is set to 255.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Transient DOS during music playback of ALAC content.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in WLAN HAL while parsing WMI command parameters.
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
Memory corruption in Graphics while processing user packets for command submission.
In the function call related to CAMREQMGRRELEASEBUF there is no check if the buffer is being used. So when a function called cammemgetcpubuf to get the kernel va to use, another thread can call CAMREQMGRRELEASEBUF to unmap the kernel va which cause UAF of the kernel address.