Qualcomm ≫ Snapdragon X35 5g Modem-rf System Firmware

Memory corruption when two threads try to map and unmap a single node simultaneously.

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

memory corruption when an invalid firehose patch command is invoked.

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

Cryptographic issue while parsing RSA keys in COBR format.

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

Memory corruption while allocating memory in HGSL driver.

Memory corruption while processing IOCTL call to set metainfo.