Buffer Over-read in WLAN Host
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.
Memory corruption while handling session errors from firmware.