The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Audio during playback with speaker protection.
Memory corruption when malformed message payload is received from firmware.
Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session.
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory Corruption in HLOS while registering for key provisioning notify.
Information disclosure while parsing the OCI IE with invalid length.
Memory corruption while power-up or power-down sequence of the camera sensor.
Memory corruption while validating number of devices in Camera kernel .
Memory corruption in Camera due to unusually high number of nodes passed to AXI port.
Memory corruption can occur in the camera when an invalid CID is used.
Information disclosure while processing information on firmware image during core initialization.
Information disclosure while processing IO control commands.
Memory corruption while parsing the memory map info in IOCTL calls.
Memory corruption while configuring a Hypervisor based input virtual device.
Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.