Memory corruption while processing a GP command response.
Memory corruption during PlayReady APP usecase while processing TA commands.
Cryptographic issue while performing RSA PKCS padding decoding.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
Memory corruption while handling file descriptor during listener registration/de-registration.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4nat'
Certain unprivileged processes are able to perform IOCTL calls.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while processing GPU page table switch.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption while processing finishsign command to pass a rsp buffer.
Memory corruption in Audio while processing RT proxy port register driver.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Transient DOS in Audio when invoking callback function of ASM driver.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains IPPROTONONE as the next header.
Transient DOS when WLAN firmware receives "reassoc response" frame including RICDATA element.
Memory corruption in Audio during playback with speaker protection.