Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption while handling session errors from firmware

Untrusted Pointer Dereference in Computer Vision

Memory corruption during session sign renewal request calls in HLOS

Memory corruption in core services when Diag handler receives a command to configure event listeners

Information disclosure while creating MQ channels

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call

Information disclosure in modem due to improper check of IP type while processing DNS server query

Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Information disclosure in Core services while processing a Diag command

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Reachable Assertion in BT Controller

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…