Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Memory corruption while parsing the ML IE due to invalid frame content.
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
Memory corruption during management frame processing due to mismatch in T2LM info element.
Information disclosure while parsing the OCI IE with invalid length.
Transient DOS while parsing per STA profile in ML IE.
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
Transient DOS while handling beacon frames with invalid IE header length.
Memory corruption while processing video packets received from video firmware.
Memory corruption while processing manipulated payload in video firmware.
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
Transient DOS when processing a received frame with an excessively large authentication information element.
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
Transient DOS when processing target power rate tables during channel configuration.
Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
Memory corruption while verifying the serialized header when the key pairs are generated.
Memory corruption in HLOS while checking for the storage type.
Memory corruption while playing audio file having large-sized input buffer.
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.
Memory corruption while configuring a Hypervisor based input virtual device.
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.