Memory corruption in Audio while processing RT proxy port register driver.
Transient DOS in WLAN Firmware while parsing a BTM request.
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
Memory corruption in HLOS while running playready use-case.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Audio during playback with speaker protection.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Information disclosure while parsing the OCI IE with invalid length.
Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.
Memory corruption while power-up or power-down sequence of the camera sensor.
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.