New Project Zero issue:

Qualcomm KGSL: reclaimed / in-reclaim objects can still be mapped into VBOs

https://bugs.chromium.org/p/project-zero/issues/detail?id=2548

CVE-2024-23384

New Project Zero issue:

PowerVR: DevmemIntChangeSparse2() UAF on PMRGetUID() call

https://bugs.chromium.org/p/project-zero/issues/detail?id=2555

CVE-2024-40671

New Project Zero issue:

Linux: LSM can prevent POSIX lock removal in fcntl/close race cleanup path

https://bugs.chromium.org/p/project-zero/issues/detail?id=2563

CVE-2024-41012,CVE-2024-41020

New Project Zero issue:

PowerVR: out-of-bounds write of firmware addresses in PVRSRVRGXKickTA3DKM()

https://bugs.chromium.org/p/project-zero/issues/detail?id=2535

CVE-2024-31336

New Project Zero issue:

PowerVR: Driver doesn't sanitize ZS-Buffer / MSAA scratch firmware addresses

https://bugs.chromium.org/p/project-zero/issues/detail?id=2536

CVE-2024-31337

New Project Zero issue:

PowerVR: DevmemXIntMapPages() allows mapping sDevZeroPage/sDummyPage without holding reference

https://bugs.chromium.org/p/project-zero/issues/detail?id=2538

CVE-2024-31334

New Project Zero issue:

PowerVR: PMR physical memory is freed before GPU TLB invalidation

https://bugs.chromium.org/p/project-zero/issues/detail?id=2540

CVE-2024-34732

New Project Zero issue:

PowerVR: integer overflows in DevmemXIntMapPages() and DevmemXIntUnmapPages(), exploitable as dangling GPU page table entries

https://bugs.chromium.org/p/project-zero/issues/detail?id=2543

CVE-2024-34733

New Project Zero issue:

PowerVR: wrapping addition in _DevmemXReservationPageAddress() causes MMU operation at wrong address

https://bugs.chromium.org/p/project-zero/issues/detail?id=2544

CVE-2024-34748

New Project Zero issue:

Telegram for Android: Use-after-free in Connection::onReceivedData

https://bugs.chromium.org/p/project-zero/issues/detail?id=2547

New Project Zero issue:

PowerVR: two security issues identified during patch review

https://bugs.chromium.org/p/project-zero/issues/detail?id=2561

CVE-2024-40670

New Project Zero issue:

Linux: DRM: refcount incremented too late in drm_file_update_pid()

https://bugs.chromium.org/p/project-zero/issues/detail?id=2562

CVE-2024-39486

New Project Zero issue:

Linux: landlock can be disabled thanks to missing cred_transfer hook; and Smack looks dodgy too

https://bugs.chromium.org/p/project-zero/issues/detail?id=2566

CVE-2024-42318