Integer Overflow or Wraparound in Graphics

Memory corruption while processing specific files in Powerline Communication Firmware

Use After Free in SCE-Mink

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Buffer Over-read in Multi Mode Call Processor

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice

Memory corruption while station LL statistic handling

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Buffer Over-read in Display

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table

Memory corruption while processing audio effects

Information disclosure while creating MQ channels

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Buffer Over-read in Multi Mode Call Processor

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…

Memory corruption while processing the update SIM PB records request

memory corruption when WiFi display APIs are invoked with large random inputs

Memory corruption may occur while processing the OIS packet parser

Memory corruption while handling test pattern generator IOCTL command

Memory corruption while processing I2C settings in Camera driver

Memory corruption while processing IOCTL command to handle buffers associated with a session

Memory corruption may occur while processing voice call registration with user

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Transient DOS in Audio when invoking callback function of ASM driver