Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address

Memory corruption while sending SMS from AP firmware

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory Corruption while accessing metadata in Display

Memory corruption in Audio while validating and mapping metadata

Memory corruption in Audio during playback session with audio effects enabled

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request

Memory Corruption due to improper validation of array index in Linux while updating adn record

Memory corruption due to improper validation of array index in Audio

Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory corruption in RIL while trying to send apdu packet

Memory corruption in Trusted Execution Environment while calling service API with invalid address

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client

Memory corruption in Linux while calling system configuration APIs

Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM

Memory corruption due to use after free in Modem while modem initialization

Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel

Memory corruption in Automotive Android OS due to improper validation of array index

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size

Memory corruption in Automotive Android OS due to improper input validation

Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon…

Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon…

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in Snapdragon Auto, Snapdragon Compute,…

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero