qualcomm / flight_rb5_5g_firmware CVEs

Transient DOS when processing target power rate tables during channel configuration.

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

Memory corruption while retrieving the CBOR data from TA.

Transient DOS while parsing per STA profile in ML IE.

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specif…

Memory corruption while processing IOCTL call for getting group info.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Memory corruption in Hypervisor when platform information mentioned is not aligned.

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Information disclosure while handling T2LM Action Frame in WLAN Host.

Memory corruption when the IOCTL call is interrupted by a signal.

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Memory corruption while processing MBSSID beacon containing several subelement IE.

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.

Memory corruption while invoking IOCTLs calls in Automotive Multimedia.

Memory corruption while invoking HGSL IOCTL context create.

Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.