Memory corruption while invoking HGSL IOCTL context create.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory corruption while processing MBSSID beacon containing several subelement IE.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Information disclosure when VI calibration state set by ADSP is greater than MAXFBSPSTATE in the response payload to AFE calibration command.
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
Memory corruption when more scan frequency list or channels are sent from the user space.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Memory corruption while parsing the ML IE due to invalid frame content.
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
Memory corruption during management frame processing due to mismatch in T2LM info element.
Information disclosure while parsing the OCI IE with invalid length.
Transient DOS while parsing per STA profile in ML IE.
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
Transient DOS while handling beacon frames with invalid IE header length.
Memory corruption while processing video packets received from video firmware.
Memory corruption while processing manipulated payload in video firmware.
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
Transient DOS when processing a received frame with an excessively large authentication information element.
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.