qualcomm / qcn9074 CVEs

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

information disclosure while invoking calibration data from user space to update firmware size.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Transient DOS may occur while parsing SSID in action frames.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption when multiple threads try to unregister the CVP buffer at the same time.

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or inv…

Memory corruption while redirecting log file to any file location with any file name.

memory corruption when an invalid firehose patch command is invoked.

Information disclosure while parsing dts header atom in Video.

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, a…

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify th…

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

Memory corruption in video driver due to type confusion error during video playback

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields