Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing command in Glink linux

Memory corruption while processing camera use case IOCTL call

Untrusted Pointer Dereference in Computer Vision

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

An app with non-privileged access can change global system brightness and cause undesired system behavior

Memory corruption in Linux when the file upload API is called with parameters having large buffer

Memory corruption in Video while calling APIs with different instance ID than the one received in initialization

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Missing Cryptographic Step in Data Modem

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it