Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Transient DOS when processing a received frame with an excessively large authentication information element.
Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore
Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.
Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Information disclosure while handling SA query action frame.
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
Information disclosure while processing IO control commands.
Transient DOS while parsing probe response and assoc response frame.
Transient DOS while processing the CU information from RNR IE.
Information disclosure during audio playback.
Information disclosure while processing information on firmware image during core initialization.
Transient DOS while parsing BTM ML IE when per STA profile is not included.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Transient DOS in WLAN Firmware while parsing a BTM request.
Transient DOS in Data Modem during DTLS handshake.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Information disclosure in Modem while processing SIB5.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Information Disclosure while processing IOCTL request in FastRPC.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Transient DOS in WLAN Firmware while processing a FTMR frame.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Transient DOS in WLAN Firmware while parsing t2lm buffers.
Transient DOS in WLAN Firmware while parsing rsn ies.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Transient DOS in Audio while remapping channel buffer in media codec decoding.
Transient DOS in WLAN Firmware while parsing FT Information Elements.
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
Transient DOS while parsing WLAN beacon or probe-response frame.
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Transient DOS while processing TID-to-link mapping IE elements.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.