The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption while processing graphics kernel driver request to create DMA fence.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption while handling session errors from firmware.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while processing GPU page table switch.
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
Memory corruption while handling file descriptor during listener registration/de-registration.
Memory corruption while using alignments for memory allocation.
Memory Corruption when processing display command line information due to improper initialization of a variable.