Qualcomm ≫ Flight Rb5 5g Platform Firmware

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

Memory corruption while processing graphics kernel driver request to create DMA fence.

Memory corruption when keymaster operation imports a shared key.

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.

Memory corruption while handling user packets during VBO bind operation.

Memory corruption when an invoke call and a TEE call are bound for the same trusted application.