Use After Free in DSP Service

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Stack-based Buffer Overflow in WLAN Firmware

Memory corruption while decoding of OTA messages from T3448 IE

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information Disclosure while parsing beacon frame in STA

Information disclosure in Modem while processing SIB5

Integer Overflow or Wraparound in GPS

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

NULL Pointer Dereference in SPS Applications

Use After Free in Automotive Audio

Out-of-bounds Write in HLOS

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing manipulated payload in video firmware

Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses

Memory corruption while operating the mailbox in Automotive

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption while processing an IOCTL call to set mixer controls

Memory corruption while sound model registration for voice activation with audio kernel driver

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption during GNSS HAL process initialization

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver

Use After Free in Qualcomm IPC

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread

Memory corruption while copying the sound model data from user to kernel buffer during sound model register

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption when multiple listeners are being registered with the same file descriptor

Memory corruption in Kernel while handling GPU operations

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Information disclosure while creating MQ channels

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Transient DOS while handling beacon frames with invalid IE header length

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem

Transient DOS while parsing probe response and assoc response frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero