Information disclosure while handling beacon or probe response frame in STA

Information disclosure while parsing sub-IE length during new IE generation

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to buffer over-read in WLAN while sending a packet to device

Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Improper Validation of Syntactic Correctness of Input in Display

Cryptographic Issues in Core

Memory corruption during concurrent SSR execution due to race condition on the global maps list

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it