Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Use After Free in DSP Service

Use After Free in Graphics

Integer Overflow or Wraparound in Display

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Missing Authentication for Critical Function in Boot

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur while processing goodbye RTCP packet from network

Use After Free in DSP Service

Use After Free in Graphics

NULL Pointer Dereference in SPS Applications

Use After Free in Automotive Audio

Buffer Copy Without Checking Size of Input in HLOS

Improper Access Control in Automotive Multimedia

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing user packets to generate page faults

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when keymaster operation imports a shared key

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Reachable Assertion in WLAN Firmware

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…