Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application.
Memory corruption while invoking remote procedure IOCTL calls.
Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.
Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.
Memory corruption while processing an IOCTL call to set mixer controls.
Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.
Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.
Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.
Memory corruption while processing user buffers.
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Memory corruption while maintaining memory maps of HLOS memory.
Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.
Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.