Memory corruption while processing API calls to NPU with invalid input

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address

Memory corruption while sending SMS from AP firmware

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption in Linux while sending DRM request

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Memory corruption due to use after free in Modem while modem initialization

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Buffer Over-read in Multi Mode Call Processor

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS during music playback of ALAC content

Cryptographic Issues in Core

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Improper Access Control for Register Interface in TZ Firmware

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE