qualcomm / qca6595au CVEs

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.

information disclosure while invoking the mailbox read API.

Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer acce…

Memory corruption while processing concurrent IOCTL calls.

Memory corruption while releasing shared resources in MinkSocket listener thread.

Memory corruption when more scan frequency list or channels are sent from the user space.

Memory corruption in Kernel while handling GPU operations.

Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.

Information disclosure in Core services while processing a Diag command.

Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory corruption in Automotive Display while destroying the image handle created using connected display driver.

Weak configuration in Automotive while VM is processing a listener request from TEE.

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.

Transient DOS in Modem while processing invalid System Information Block 1.

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.

Memory Corruption due to improper validation of array index in Linux while updating adn record.

Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.

Information disclosure in Automotive multimedia due to buffer over-read.

Memory corruption in RIL while trying to send apdu packet.

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

Memory corruption due to untrusted pointer dereference in automotive during system call.

Memory corruption in Trusted Execution Environment while calling service API with invalid address.