Information disclosure while handling SA query action frame.

INformation disclosure while handling Multi-link IE in beacon frame.

Information Disclosure while parsing beacon frame in STA.

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Memory corruption when more scan frequency list or channels are sent from the user space.

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

Information disclosure while handling T2LM Action Frame in WLAN Host.

Memory corruption while playing audio file having large-sized input buffer.

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Memory corruption while verifying the serialized header when the key pairs are generated.

Memory corruption in HLOS while checking for the storage type.

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.

Memory corruption while copying the sound model data from user to kernel buffer during sound model register.

Memory corruption when the bandpass filter order received from AHAL is not within the expected range.