Qualcomm ≫ Sa8540p Firmware

Transient DOS while processing the CU information from RNR IE.

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Cryptographic issue while parsing RSA keys in COBR format.