diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
index 102e9904..e698ea94 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
-// SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 /**
  * @file drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
@@ -335,7 +335,7 @@ static long isp_channel_ioctl(
 
 	switch (_IOC_NR(cmd)) {
 	case _IOC_NR(ISP_CAPTURE_SETUP): {
-		struct isp_capture_setup setup;
+		struct isp_capture_setup setup = {};
 
 		if (copy_from_user(&setup, ptr, sizeof(setup)))
 			break;
@@ -389,7 +389,7 @@ static long isp_channel_ioctl(
 	}
 
 	case _IOC_NR(ISP_CAPTURE_REQUEST): {
-		struct isp_capture_req req;
+		struct isp_capture_req req = {};
 
 		if (copy_from_user(&req, ptr, sizeof(req)))
 			break;
@@ -413,7 +413,7 @@ static long isp_channel_ioctl(
 	}
 
 	case _IOC_NR(ISP_CAPTURE_PROGRAM_REQUEST): {
-		struct isp_program_req program_req;
+		struct isp_program_req program_req = {};
 
 		if (copy_from_user(&program_req, ptr, sizeof(program_req)))
 			break;
@@ -434,7 +434,7 @@ static long isp_channel_ioctl(
 	}
 
 	case _IOC_NR(ISP_CAPTURE_REQUEST_EX): {
-		struct isp_capture_req_ex req;
+		struct isp_capture_req_ex req = {};
 
 		if (copy_from_user(&req, ptr, sizeof(req)))
 			break;
diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
index 8c3f659d..6365e63f 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
-// SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 /**
  * @file drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
@@ -578,6 +578,11 @@ static void isp_capture_request_unpin(
 	}
 
 	mutex_lock(&capture->capture_desc_ctx.unpins_list_lock);
+	if (buffer_index >= capture->program_desc_ctx.queue_depth) {
+		dev_err(chan->isp_dev,
+			"%s: buffer index is out of bound\n", __func__);
+		return;
+	}
 	unpins = &capture->capture_desc_ctx.unpins_list[buffer_index];
 	if (unpins->num_unpins != 0U) {
 		for (i = 0; i < unpins->num_unpins; i++)
@@ -609,6 +614,11 @@ static void isp_capture_program_request_unpin(
 	}
 
 	mutex_lock(&capture->program_desc_ctx.unpins_list_lock);
+	if (buffer_index >= capture->program_desc_ctx.queue_depth) {
+		dev_err(chan->isp_dev,
+			"%s: buffer index is out of bound\n", __func__);
+		return;
+	}
 	unpins = &capture->program_desc_ctx.unpins_list[buffer_index];
 	if (unpins->num_unpins != 0U) {
 		for (i = 0; i < unpins->num_unpins; i++)
@@ -1115,6 +1125,12 @@ void isp_get_nvhost_device(
 	struct tegra_capture_isp_data *info =
 		platform_get_drvdata(chan->isp_capture_pdev);
 
+	if (isp_inst >= MAX_ISP_UNITS) {
+		dev_err(chan->isp_dev,
+			"%s: ISP unit index is out of bound\n", __func__);
+		return;
+	}
+
 	chan->isp_dev = &info->isp_pdevices[isp_inst]->dev;
 	chan->ndev = info->isp_pdevices[isp_inst];
 }
diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c
index 4049b6fa..be9a9707 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
-// SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 /**
  * @file drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c
@@ -403,7 +403,7 @@ static long vi_channel_ioctl(
 
 	switch (_IOC_NR(cmd)) {
 	case _IOC_NR(VI_CAPTURE_SETUP): {
-		struct vi_capture_setup setup;
+		struct vi_capture_setup setup = {};
 
 		if (copy_from_user(&setup, ptr, sizeof(setup)))
 			break;
@@ -524,7 +524,7 @@ static long vi_channel_ioctl(
 	}
 
 	case _IOC_NR(VI_CAPTURE_SET_CONFIG): {
-		struct vi_capture_control_msg msg;
+		struct vi_capture_control_msg msg = {};
 
 		if (copy_from_user(&msg, ptr, sizeof(msg)))
 			break;
diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c
index 59846b5b..997047f7 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
-/* SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES.
+/* SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES.
  * All rights reserved.
  *
  *
@@ -580,6 +580,12 @@ void vi_get_nvhost_device(
 	struct tegra_capture_vi_data *info =
 		platform_get_drvdata(chan->vi_capture_pdev);
 
+	if (setup->csi_stream_id >= MAX_NVCSI_STREAM_IDS) {
+		dev_err(chan->dev,
+			"%s: csi stream id is out of bound\n", __func__);
+		return;
+	}
+
 	vi_inst = info->vi_instance_table[setup->csi_stream_id];
 
 	if (vi_inst >= MAX_VI_UNITS) {