Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode

Memoru corruption in Audio when ADSP sends input during record use case

Memory corruption due to improper access control in kernel while processing a mapping request from root process

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool

Buffer Over-read in WLAN Host Communication

Transient DOS may occur while parsing SSID in action frames

Transient DOS may occur while processing the country IE

Information disclosure while parsing the OCI IE with invalid length

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS while parsing probe response and assoc response frame

Transient DOS while processing TID-to-link mapping IE elements

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Improper Input Validation in Trusted Execution Environment

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Transient DOS while processing the CU information from RNR IE

Buffer Over-read in FM Host

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction