Qualcomm ≫ Wcn3988 Firmware

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

Memory corruption due to global buffer overflow when a test command uses an invalid payload type.

information disclosure while invoking calibration data from user space to update firmware size.

Memory corruption while performing private key encryption in trusted application.

Memory corruption while processing specific files in Powerline Communication Firmware.

Transient DOS while processing CCCH data when NW sends data with invalid length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Memory corruption while submitting blob data to kernel space though IOCTL.