CVE-2026-24082

all versions

Memory Corruption when copying data from a freed source while executing performance counter deselect operation.

7.8HIGH

CVE-2025-47404

all versions

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

6.5MEDIUM

CVE-2025-47403

all versions

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

6.5MEDIUM

CVE-2025-47401

all versions

Transient DOS when processing target power rate tables during channel configuration.

6.5MEDIUM

CVE-2026-21381

all versions

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness netwo

7.6HIGH

CVE-2026-21367

all versions

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

7.6HIGH

CVE-2025-47392

all versions

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

8.8HIGH

CVE-2025-47389

all versions

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

7.8HIGH

CVE-2025-47386

all versions

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

7.8HIGH

CVE-2025-47383

all versions

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

7.2HIGH

CVE-2025-47379

all versions

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocati

7.8HIGH

CVE-2025-47377

all versions

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

7.8HIGH

CVE-2025-47376

all versions

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

7.8HIGH

CVE-2025-47375

all versions

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

7.8HIGH

CVE-2025-47373

all versions

Memory Corruption when accessing buffers with invalid length during TA invocation.

7.8HIGH

CVE-2025-47371

all versions

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

6.5MEDIUM

CVE-2025-47402

all versions

Transient DOS when processing a received frame with an excessively large authentication information element.

6.5MEDIUM