CVE-2025-21446

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

CVE-2025-21452

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

CVE-2025-27075

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

CVE-2025-27076

Memory corruption while processing simultaneous requests via escape path.

CVE-2025-21477

Transient DOS while processing CCCH data when NW sends data with invalid length.