qualcomm / wcn3990_firmware CVEs

Possible out of bound access in audio module due to lack of validation of user provided input.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.

Memory corruption during session sign renewal request calls in HLOS.

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

Transient DOS during music playback of ALAC content.

Information disclosure due to buffer overread in Linux sensors

Memory corruption in Core due to improper configuration in boot remapper.