qualcomm / wsa8832 CVEs

Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.

Memory corruption while processing IOCTL command when device is in power-save state.

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory corruption while processing a frame request from user.

Memory corruption while performing sensor register read operations.

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.

Memory corruption while processing camera TPG write request.

Memory corruption due to improper bounds check while command handling in camera-kernel driver.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while processing GPU commands.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while handling session errors from firmware.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Transient DOS while processing the CU information from RNR IE.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption while processing IOCTL calls to unmap the buffers.

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Transient DOS while parsing probe response and assoc response frame.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.