Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Memory Corruption in WLAN HOST while fetching TX status information.
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
Transient DOS when processing target power rate tables during channel configuration.
Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
Memory corruption may occour while generating test pattern due to negative indexing of display ID.
Information disclosure during audio playback.
Information disclosure while processing IO control commands.
Memory corruption while parsing the memory map info in IOCTL calls.
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesnt validate the IPC message received from the firmware.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
Transient DOS during music playback of ALAC content.
Memory corruption while allocating memory in HGSL driver.
Memory corruption while processing IOCTL call to set metainfo.
Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.
Memory corruption while station LL statistic handling.