Transient DOS while parsing WPA IES, when it is passed with length more than expected size

Transient DOS when processing a NULL buffer while parsing WLAN vdev

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids

Transient DOS in Bluetooth Host while rfc slot allocation

Transient DOS in WLAN Firmware while parsing rsn ies

Transient DOS in WLAN Firmware while parsing a NAN management frame

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS in WLAN Firmware while processing frames with missing header fields

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Missing Authentication for Critical Function in HLOS

Improper Input Validation in Trusted Execution Environment

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Out of Bounds write in Linux Camera

Memory corruption while handling buffer mapping operations in the cryptographic driver

Integer Underflow (Wrap or Wraparound) in WLAN Host

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Buffer Over-read in WLAN Host Communication

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction