In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code

In multiple locations, there is a possible arbitrary code execution due to a logic error in the code

In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation

In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow

In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code

In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code

In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code

In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a missing bounds check

In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free

In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free

In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free

In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition

In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition