CVE-2025-21479

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CVE-2025-21480

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CVE-2025-21424

Memory corruption while calling the NPU driver APIs concurrently.

CVE-2025-21468

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

CVE-2024-53027

Transient DOS may occur while processing the country IE.

CVE-2024-49834

Memory corruption while power-up or power-down sequence of the camera sensor.

CVE-2025-21453

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

CVE-2024-53024

Memory corruption in display driver while detaching a device.

CVE-2024-53014

Memory corruption may occur while validating ports and channels in Audio driver.

CVE-2024-49835

Memory corruption while reading secure file.

CVE-2025-21475

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.

CVE-2025-21470

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.

CVE-2025-21469

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.

CVE-2024-45541

Memory corruption when IOCTL call is invoked from user-space to read board data.

CVE-2024-45573

Memory corruption may occour while generating test pattern due to negative indexing of display ID.

CVE-2024-45561

Memory corruption while handling IOCTL call from user-space to set latency level.

CVE-2024-45560

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

CVE-2024-43051

Information disclosure while deriving keys for a session for any Widevine use case.

CVE-2024-45542

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVE-2025-21421

Memory corruption while processing escape code in API.

CVE-2025-21441

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVE-2025-21423

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.

CVE-2025-21440

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVE-2025-27031

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

CVE-2025-27061

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

CVE-2025-27042

Memory corruption while processing video packets received from video firmware.

CVE-2025-21427

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

CVE-2025-21432

Memory corruption while retrieving the CBOR data from TA.

CVE-2025-21433

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

CVE-2025-21466

Memory corruption while processing a private escape command in an event trigger.

CVE-2025-27047

Memory corruption while processing the TESTPATTERNCONFIG escape path.

CVE-2025-27050

Memory corruption while processing event close when client process terminates abruptly.

CVE-2025-27055

Memory corruption during the image encoding process.

CVE-2025-21446

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

CVE-2025-21449

Transient DOS may occur while processing malformed length field in SSID IEs.

CVE-2025-21452

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

CVE-2025-27075

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

CVE-2025-27076

Memory corruption while processing simultaneous requests via escape path.

CVE-2025-21477

Transient DOS while processing CCCH data when NW sends data with invalid length.