qualcomm / wsa8835_firmware CVEs

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.

Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.

Memory corruption while processing IOCTL command when device is in power-save state.

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory corruption while processing a frame request from user.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.

Memory corruption while performing sensor register read operations.

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.

Memory corruption while processing an IOCTL command with an arbitrary address.

Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.

Information disclosure while capturing logs as eSE debug messages are logged.

Memory corruption while processing camera TPG write request.

Memory corruption can occur during context user dumps due to inadequate checks on buffer length.

Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.

Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.

Memory corruption due to improper bounds check while command handling in camera-kernel driver.

Memory corruption while processing IOCTL calls.

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.

Possible out of bound access in audio module due to lack of validation of user provided input.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU page table switch.