Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto, Snapdragon…

Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon…

Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Transient DOS while processing power control requests with invalid antenna or stream values

Transient DOS while processing an ANQP message

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS may occur while parsing SSID in action frames

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS while parsing probe response and assoc response frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS in Bluetooth Host while rfc slot allocation

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS in WLAN Firmware while parsing FT Information Elements

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Transient DOS due to buffer over-read in WLAN while sending a packet to device

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes

Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state

Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data

Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed

Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes

Information disclosure in Audio while accessing AVCS services from ADSP payload

Memory corruption while parsing the memory map info in IOCTL calls

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Information disclosure while processing the hash segment in an MBN file

Information disclosure while reading data from an image using specified offset and size parameters

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device

Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Information disclosure while registering commands from clients with diag through diagHal

information disclosure while invoking calibration data from user space to update firmware size