Use After Free in DSP Service

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input

Memory corruption while processing identity credential operations in the trusted application

Memory corruption while processing a malformed license file during reboot

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while processing manipulated payload in video firmware

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while reading secure file

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption in display driver while detaching a device

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing user packets to generate page faults

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when keymaster operation imports a shared key

Memory corruption while handling user packets during VBO bind operation

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Transient DOS while processing received beacon frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Memory corruption while handling buffer mapping operations in the cryptographic driver

Transient DOS while processing video packets received from video firmware

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Information disclosure in WLAN HAL when reception status handler is called

Information disclosure in WLAN HAL while handling the WMI state info command

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request