Qualcomm ≫ Srv1h Firmware

INformation disclosure while handling Multi-link IE in beacon frame.

Information disclosure while handling SA query action frame.

transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.

Memory corruption while playing audio file having large-sized input buffer.

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Memory corruption when the IOCTL call is interrupted by a signal.

Memory corruption in HLOS while checking for the storage type.

Memory corruption while verifying the serialized header when the key pairs are generated.

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Memory corruption when the payload received from firmware is not as per the expected protocol size.