Qualcomm ≫ Wcn3990 Firmware

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

Memory corruption while configuring a Hypervisor based input virtual device.

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Possible out of bound access in audio module due to lack of validation of user provided input.