Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing IOCTL calls to unmap the buffers

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption in Kernel while handling GPU operations

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN HAL

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Transient DOS may occur while parsing SSID in action frames

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem

Transient DOS while parsing probe response and assoc response frame

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Improper Input Validation in Trusted Execution Environment

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Out of Bounds write in Linux Camera

Buffer Over-read in WLAN Firmware

Reachable Assertion in BT Controller

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Over-read in Video

Buffer Over-read in WLAN Host Communication