Information disclosure while parsing dts header atom in Video.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
Memory corruption during management frame processing due to mismatch in T2LM info element.
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
Memory corruption while processing manipulated payload in video firmware.
Memory corruption in HLOS while invoking IOCTL calls from user-space.
Memory corruption while processing data packets in diag received from Unix clients.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while parse fils IE with length equal to 1.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption while invoking HGSL IOCTL context create.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when the payload received from firmware is not as per the expected protocol size.