Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while parsing clock configuration data for a specific hardware type

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Out of Bounds write in Linux Camera

Transient DOS when processing a received frame with an excessively large authentication information element

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Memory corruption while processing a config call from userspace

Information disclosure while processing a firmware event

Buffer Over-read in WLAN Host Communication

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID

Transient DOS while parsing video packets received from the video firmware

Transient DOS can occur while processing UCI command

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver