Qualcomm ≫ Sxr2230p Firmware

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while processing the CU information from RNR IE.

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.

Transient DOS while parsing probe response and assoc response frame.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Memory corruption while processing IOCTL call for getting group info.

Memory corruption when user provides data for FM HCI command control operations.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Memory corruption when two threads try to map and unmap a single node simultaneously.