Qualcomm ≫ Snapdragon 8cx Gen 3 Compute Platform Firmware

Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

Transient DOS while parse fils IE with length equal to 1.

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.