High · published September 17, 2026
Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
| Product | Versions | Fixed in |
|---|---|---|
| qualcomm/qca6696_firmware | all versions | — |
| qualcomm/qca6698aq_firmware | all versions | — |
| qualcomm/lemans_au_lgit_firmware | all versions | — |
| qualcomm/lemansau_firmware | all versions | — |
| qualcomm/qam8255p_firmware | all versions | — |
| qualcomm/qam8295p_firmware | all versions | — |
| qualcomm/qam8620p_firmware | all versions | — |
| qualcomm/qamsrv1h_firmware | all versions | — |
| qualcomm/qamsrv1m_firmware | all versions | — |
| qualcomm/qca6574au_firmware | all versions | — |
| qualcomm/qca6595_firmware | all versions | — |
| qualcomm/qca6595au_firmware | all versions | — |
| qualcomm/qca6688aq_firmware | all versions | — |
| qualcomm/qca6797aq_firmware | all versions | — |
| qualcomm/qca8695au_firmware | all versions | — |
| qualcomm/sa6155p_firmware | all versions | — |
| qualcomm/sa7255p_firmware | all versions | — |
| qualcomm/sa7775p_firmware | all versions | — |
| qualcomm/sa8155p_firmware | all versions | — |
| qualcomm/sa8195p_firmware | all versions | — |
| qualcomm/sa8255p_firmware | all versions | — |
| qualcomm/sa8295p_firmware | all versions | — |
| qualcomm/sa8540p_firmware | all versions | — |
| qualcomm/sa8620p_firmware | all versions | — |
| qualcomm/sa8770p_firmware | all versions | — |
| qualcomm/sa9000p_firmware | all versions | — |
| qualcomm/srv1h_firmware | all versions | — |
| qualcomm/srv1l_firmware | all versions | — |
| qualcomm/srv1m_firmware | all versions | — |