Qualcomm ≫ Wcn3980 Firmware

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.

Memory corruption in WLAN Host while processing RRM beacon on the AP.

Memory corruption in Core while processing RX intent request.

Memory corruption when processing cmd parameters while parsing vdev.