Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon…

Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Buffer Over-read in WLAN HAL

Transient DOS while processing an ANQP message

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS may occur while parsing SSID in action frames

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS while parsing probe response and assoc response frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS in Bluetooth Host while rfc slot allocation

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS in WLAN Firmware while parsing FT Information Elements

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Transient DOS due to buffer over-read in WLAN while sending a packet to device

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes

Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state

Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data

Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed

Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes

Information disclosure in Audio while accessing AVCS services from ADSP payload

Memory corruption while parsing the memory map info in IOCTL calls

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it