Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Modem after RRC Setup message is received

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE

Transient DOS in WLAN Firmware while parsing t2lm buffers

Transient DOS in WLAN Firmware while parsing no-inherit IES

Transient DOS in WLAN Firmware while parsing rsn ies

Transient DOS in WLAN Firmware while parsing a NAN management frame

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Transient DOS in Audio while remapping channel buffer in media codec decoding

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware while parsing FT Information Elements

Transient DOS in WLAN Firmware while processing frames with missing header fields

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame

Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to improper authorization in Modem

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call

Information disclosure in modem due to improper check of IP type while processing DNS server query

Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction

Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue

information disclosure due to cryptographic issue in Core during RPMB read request

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation