Use After Free in DSP Service

Use After Free in Graphics

Integer Overflow or Wraparound in GPS

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Missing Authentication for Critical Function in Data Modem

Use After Free in Graphics

Buffer Over-read in Graphics

Improper Access Control for Register Interface in SCE-Mink

Use After Free in Automotive Audio

Memory corruption occurs when a secure application is launched on a device with insufficient memory

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations

Memory corruption while passing pages to DSP with an unaligned starting address

Memory corruption while loading an invalid firmware in boot loader

Memory corruption while processing MFC channel configuration during music playback

Memory corruption while allocating buffers in DSP service

Memory corruption while handling invalid inputs in application info setup

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while processing commands from A2dp sink command queue

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while reading the FW response from the shared queue

Memory corruption while prociesing command buffer buffer in OPE module

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Use After Free in Qualcomm IPC

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address