Qualcomm
Monthly
Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.
Local memory corruption in Qualcomm Snapdragon-based devices can be triggered by a low-privileged local attacker supplying a crafted large data buffer that overflows an additive length check. Successful exploitation grants high confidentiality, integrity, and availability impact within the affected component, matching a local privilege-escalation profile rather than a remote attack primitive. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not specify the vulnerable subsystem or exact chipset models.
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.
Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Denial of service in Qualcomm Snapdragon-based devices allows adjacent-network attackers to cause a transient, recoverable outage by sending large or numerous request buffers to a subsystem that fails to validate memory allocation. The vulnerability requires no authentication or user interaction but demands proximity within radio/link-layer range (CVSS 3.1 score 7.4, AV:A/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the impact is limited to availability; data confidentiality and integrity remain unaffected.
Local privilege escalation in Qualcomm Snapdragon platforms can occur when a low-privileged local process supplies an insufficiently sized user buffer to an escape handling driver flow, producing an out-of-bounds write (CWE-787). The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so an attacker who already has a foothold on the device as a low-privileged user could corrupt memory and potentially achieve code execution or elevation; authentication requirements are local low privileges per the vector, and no user interaction is required. No public exploit identified at time of analysis, and the assessed risk is a genuine local privilege-escalation issue that is not a drop-everything emergency; Qualcomm's September 2026 security bulletin is the primary advisory, though exact affected chipsets and patched versions are not enumerated in the provided data.
Memory corruption in Qualcomm Snapdragon I2C transfer request handling can allow a local low-privileged attacker to corrupt memory and potentially achieve privilege escalation or impact confidentiality, integrity, and availability by winning a race condition between memory allocation and data copying. The assessed risk is local-only and high-complexity because exploitation requires code execution on the device and repeated concurrent requests to hit the timing window, and no public exploit identified at time of analysis. Affected platforms are Qualcomm Snapdragon chipsets, with the vendor's September 2026 security bulletin providing the authoritative mapping and remediation guidance.
Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.
Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.
Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.
Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.
Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.
Denial-of-service (NULL-pointer dereference / use-after-free) in the Linux kernel's in-kernel SMB3 server (ksmbd) affects systems that offload SMB3 message encryption to asynchronous hardware crypto engines such as the Qualcomm Crypto Engine (QCE). ksmbd_crypt_message() installs a NULL completion callback and misinterprets the -EINPROGRESS return from async AEAD requests as a fatal error, freeing the request while the hardware DMA is still running so the later qce_skcipher_done() callback dereferences freed memory and crashes the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), consistent with the narrow hardware/configuration prerequisites despite the NVD CVSS of 9.8.
Out-of-bounds read in the Linux kernel's AppArmor LSM subsystem (security/apparmor/match.c) allows a local low-privileged user to trigger a KASAN slab-out-of-bounds read via the mount() syscall on kernels 7.0 through 7.0.3 and 7.1-rc1. The flaw stems from a missing string terminator that causes aa_dfa_match() to read past the end of an 8KB kmalloc buffer when processing mount path strings, resulting in potential information disclosure and system instability (denial of service). No public exploit identified at time of analysis, and EPSS probability is negligible at 0.02%.
Memory corruption in Linux kernel on Qualcomm Monaco-based ARM64 platforms causes kernel crashes through synchronous external aborts when accessing hypervisor-owned memory incorrectly marked as conventional RAM. The firmware's EFI memory map only reserves 288 KiB of a 512 KiB Gunyah hypervisor metadata region (0x91a80000-0x91afffff), leaving 224 KiB exploitable for triggering fatal aborts. Patches available for stable branches 6.18.24, 6.19.14, and 7.0 series. EPSS exploitation probability is very low (0.02%, 4th percentile) with no known active exploitation or public POC, indicating limited real-world threat despite CVSS 7.5 rating.
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memory allocation, enabling local privilege escalation to kernel level. KEV-listed and patched, this vulnerability affects Qualcomm-based mobile devices and embedded systems, potentially impacting billions of Android devices globally.
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized command execution path during specific GPU command sequences. KEV-listed alongside CVE-2025-21480, this indicates a systemic issue in Qualcomm's GPU micronode command validation that is being actively exploited in mobile attack chains.
Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory corruption during graphics rendering. KEV-listed, this vulnerability can be triggered through Chrome on Android devices with Qualcomm chipsets, providing a kernel-level exploitation path from web content.
Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized command execution during specific GPU command sequences. KEV-listed, this vulnerability enables privilege escalation from the GPU context, potentially allowing app-level attackers to gain kernel access through the GPU driver on Qualcomm-based Android devices.
Memory corruption while maintaining memory maps of HLOS memory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Memory corruption in DSP Services during a remote call from HLOS to DSP. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSH_IDLE when the link was never enabled msm_dp_display_atomic_enable() returns early when link training fails, leaving ->power_on false and the main link down. msm_dp_display_atomic_disable() nevertheless writes DP_STATE_CTRL_PUSH_IDLE and waits for an idle-pattern completion that cannot arrive, so every failed enable is followed by "PUSH_IDLE pattern timedout". Every other step of the teardown is already gated on that flag: msm_dp_display_disable(), called from .atomic_post_disable(), returns early on !power_on. The PUSH_IDLE write is the only one that is not, so the controller's runtime-PM reference is then dropped without the link having been taken down. On glymur (Snapdragon X2 Elite) the consequence is not a warning. The SoC does not survive it: TrustZone force-stops the SOCCP and ADSP remote processors and the machine resets silently about 50 ms later, with no oops and no panic. On an ASUS Zenbook A16 (UX3607OA), whose eDP panel does not currently train, this reproduces without any compositor or GPU involvement: # eDP enable has already failed with "Failed link training (rc=-104)" echo 1 > /sys/class/graphics/fb0/blank [535.645455] === marker === [535.694833] qcom_q6v5_pas d00000.remoteproc: fatal error received: \ sys_m_smsm.c:512:TZ force stop [535.694875] remoteproc remoteproc0: crash detected in soccp: type fatal error [535.728857] qcom_q6v5_pas 6800000.remoteproc: fatal error received: \ sys_m_smsm.c:783:err fatal notification received from TZ <SoC reset> Gate the PUSH_IDLE write on ->power_on so the disable path is consistent with the rest of the teardown. With this applied the same sequence is harmless and the machine stays up; without it, it resets every time. The unconditional write dates back to the original DP driver (c943b4948b58 ("drm/msm/dp: add displayPort driver support")), but the surrounding code has been restructured several times since, so no Fixes: tag is offered. Note that the eDP link-training failure that exposes this on the A16 is a separate problem in the glymur eDP PHY and is reported separately; this change is about not damaging the machine when training fails, for whatever reason. Tested on ASUS Zenbook A16 (UX3607OA), Snapdragon X2 Elite Extreme, on linux-next next-20260803 and next-20260807. The machine has since been running next-20260807 with this patch as its daily driver. Patchwork: https://patchwork.freedesktop.org/patch/745167/
Memory corruption in Qualcomm Snapdragon platforms allows an attacker who already holds a low-privileged local foothold on the device to corrupt memory by feeding oversized input into a copy routine that exceeds expected allocation limits, giving high impact to confidentiality, integrity, and availability of the affected component. The flaw is not remotely exploitable on its own: exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) - for example a malicious or compromised application able to reach the vulnerable code path - and no user interaction is needed. No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided; the referenced Qualcomm September 2026 security bulletin is the authoritative source for the specific affected chipsets and fixed versions.
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations.
NULL pointer dereference in the Linux kernel's ASoC QCOM QDSP6 subsystem crashes systems built on Qualcomm SA8775P and SC8280XP SoCs during ADSP protection-domain restart cycles. The crash occurs because the q6apm-audio .remove callback prematurely deletes Runtime Descriptions (RTDs) containing q6apm DAI components during ASoC teardown, leaving those components still linked to the sound card and triggering a kernel oops on the subsequent rebind. Impact is limited to availability (kernel panic/denial of service); no public exploit has been identified at time of analysis, and EPSS at 0.02% reflects very low widespread exploitation probability.
Memory Corruption when processing invalid user address with nonstandard buffer address. [CVSS 7.8 HIGH]
Memory Corruption when adding user-supplied data without checking available buffer space. [CVSS 7.8 HIGH]
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. [CVSS 7.8 HIGH]
Memory Corruption when accessing trusted execution environment without proper privilege check. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - is affected by reachable assertion (CVSS 6.5).
5G Fixed Wireless Access Platform Firmware versions up to - contains a vulnerability that allows attackers to cryptographic issue when a VoWiFi call is triggered from UE (CVSS 7.2).
Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. [CVSS 7.8 HIGH]
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. [CVSS 7.8 HIGH]
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. [CVSS 7.1 HIGH]
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. [CVSS 7.8 HIGH]
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. [CVSS 7.8 HIGH]
Memory corruption while handling different IOCTL calls from the user-space simultaneously. [CVSS 7.8 HIGH]
Memory Corruption when accessing buffers with invalid length during TA invocation. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - is affected by reachable assertion (CVSS 6.5).
A race condition in the Linux kernel's serial driver allows local attackers with low privileges to bypass TTY device linkage during console configuration, potentially enabling unauthorized access to serial console interfaces on Qualcomm SoCs and other affected systems. The vulnerability stems from improper initialization ordering that fails to configure tty->port before uart_configure_port() is called, creating a window where user-space applications can open the console without proper driver linkage. No patch is currently available.
Transient DOS when processing a received frame with an excessively large authentication information element. [CVSS 6.5 MEDIUM]
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. [CVSS 7.8 HIGH]
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. [CVSS 7.8 HIGH]
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. [CVSS 7.8 HIGH]
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. [CVSS 7.1 HIGH]
Memory corruption while calculating offset from partition start point. [CVSS 6.8 MEDIUM]
Memory corruption when calculating oversized partition sizes without proper checks. [CVSS 6.8 MEDIUM]
Memory Corruption when multiple threads simultaneously access a memory free API. [CVSS 7.8 HIGH]
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. [CVSS 7.8 HIGH]
Memory corruption occurs when a secure application is launched on a device with insufficient memory. [CVSS 7.8 HIGH]
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. [CVSS 6.5 MEDIUM]
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. [CVSS 7.8 HIGH]
Memory corruption when accessing resources in kernel driver. [CVSS 7.8 HIGH]
Memory corruption while passing pages to DSP with an unaligned starting address. [CVSS 7.8 HIGH]
Memory corruption while preprocessing IOCTLs in sensors. [CVSS 7.8 HIGH]
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. [CVSS 5.5 MEDIUM]
Memory Corruption when multiple threads concurrently access and modify shared resources. [CVSS 7.8 HIGH]
Memory corruption while processing identity credential operations in the trusted application. [CVSS 7.8 HIGH]
Memory corruption while processing a secure logging command in the trusted application. [CVSS 7.8 HIGH]
Cryptographic issue may occur while encrypting license data. [CVSS 8.4 HIGH]
Memory corruption while handling sensor utility operations. [CVSS 6.7 MEDIUM]
Video Collaboration Vc3 Platform Firmware versions up to - contains a security vulnerability (CVSS 7.8).
Memory corruption while deinitializing a HDCP session. [CVSS 7.8 HIGH]
Memory corruption while accessing a synchronization object during concurrent operations. [CVSS 6.7 MEDIUM]
Memory corruption while performing sensor register read operations. [CVSS 6.7 MEDIUM]
Memory corruption while parsing clock configuration data for a specific hardware type. [CVSS 6.7 MEDIUM]
Memory corruption while processing shared command buffer packet between camera userspace and kernel. [CVSS 6.7 MEDIUM]
Memory corruption while handling buffer mapping operations in the cryptographic driver. [CVSS 6.6 MEDIUM]
Memory corruption while processing a config call from userspace. [CVSS 6.7 MEDIUM]
Information disclosure while processing a firmware event. [CVSS 6.1 MEDIUM]
Transient DOS while parsing video packets received from the video firmware. [CVSS 5.5 MEDIUM]
Memory corruption in Qualcomm firmware's Generic Packet Router (GPR) lets a locally present, low-privileged attacker escalate to root-level code execution on a broad range of Snapdragon, FastConnect, QAM/QCA/QCN and related chipsets. Per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw requires an existing foothold as an unprivileged local process - a malicious or compromised app, for example - which then routes an oversized data packet through the GPR path that bridges user and root/kernel contexts, triggering a CWE-190 integer overflow and full compromise of confidentiality, integrity and availability. It is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis; Qualcomm published the issue in its December 2025 security bulletin for OEM distribution.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Asserting RST_N low. - Turning off REF_CLK. - Turning off VCC. - Turning off VCCQ/VCCQ2. As part of ufs shutdown, after the SSU command completion, asserting hardware reset (HWRST) triggers the device firmware to wake up and execute its reset routine. This routine initializes hardware blocks and takes a few milliseconds to complete. During this time, the ICCQ draws a large current. This large ICCQ current may cause issues for the regulator which is supplying power to UFS, because the turn off request from UFS driver to the regulator framework will be immediately followed by low power mode(LPM) request by regulator framework. This is done by framework because UFS which is the only client is requesting for disable. So if the rail is still in the process of shutting down while ICCQ exceeds LPM current thresholds, and LPM mode is activated in hardware during this state, it may trigger an overcurrent protection (OCP) fault in the regulator. To prevent this, a 10ms delay is added after asserting HWRST. This allows the reset operation to complete while power rails remain active and in high-power mode. Currently there is no way for Host to query whether the reset is completed or not and hence this the delay is based on experiments with Qualcomm UFS controllers across multiple UFS vendors.
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its. No vendor patch available.
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.
Local memory corruption in Qualcomm Snapdragon-based devices can be triggered by a low-privileged local attacker supplying a crafted large data buffer that overflows an additive length check. Successful exploitation grants high confidentiality, integrity, and availability impact within the affected component, matching a local privilege-escalation profile rather than a remote attack primitive. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not specify the vulnerable subsystem or exact chipset models.
Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.
Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.
Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Denial of service in Qualcomm Snapdragon-based devices allows adjacent-network attackers to cause a transient, recoverable outage by sending large or numerous request buffers to a subsystem that fails to validate memory allocation. The vulnerability requires no authentication or user interaction but demands proximity within radio/link-layer range (CVSS 3.1 score 7.4, AV:A/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the impact is limited to availability; data confidentiality and integrity remain unaffected.
Local privilege escalation in Qualcomm Snapdragon platforms can occur when a low-privileged local process supplies an insufficiently sized user buffer to an escape handling driver flow, producing an out-of-bounds write (CWE-787). The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so an attacker who already has a foothold on the device as a low-privileged user could corrupt memory and potentially achieve code execution or elevation; authentication requirements are local low privileges per the vector, and no user interaction is required. No public exploit identified at time of analysis, and the assessed risk is a genuine local privilege-escalation issue that is not a drop-everything emergency; Qualcomm's September 2026 security bulletin is the primary advisory, though exact affected chipsets and patched versions are not enumerated in the provided data.
Memory corruption in Qualcomm Snapdragon I2C transfer request handling can allow a local low-privileged attacker to corrupt memory and potentially achieve privilege escalation or impact confidentiality, integrity, and availability by winning a race condition between memory allocation and data copying. The assessed risk is local-only and high-complexity because exploitation requires code execution on the device and repeated concurrent requests to hit the timing window, and no public exploit identified at time of analysis. Affected platforms are Qualcomm Snapdragon chipsets, with the vendor's September 2026 security bulletin providing the authoritative mapping and remediation guidance.
Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.
Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.
Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.
Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.
Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.
Denial-of-service (NULL-pointer dereference / use-after-free) in the Linux kernel's in-kernel SMB3 server (ksmbd) affects systems that offload SMB3 message encryption to asynchronous hardware crypto engines such as the Qualcomm Crypto Engine (QCE). ksmbd_crypt_message() installs a NULL completion callback and misinterprets the -EINPROGRESS return from async AEAD requests as a fatal error, freeing the request while the hardware DMA is still running so the later qce_skcipher_done() callback dereferences freed memory and crashes the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), consistent with the narrow hardware/configuration prerequisites despite the NVD CVSS of 9.8.
Out-of-bounds read in the Linux kernel's AppArmor LSM subsystem (security/apparmor/match.c) allows a local low-privileged user to trigger a KASAN slab-out-of-bounds read via the mount() syscall on kernels 7.0 through 7.0.3 and 7.1-rc1. The flaw stems from a missing string terminator that causes aa_dfa_match() to read past the end of an 8KB kmalloc buffer when processing mount path strings, resulting in potential information disclosure and system instability (denial of service). No public exploit identified at time of analysis, and EPSS probability is negligible at 0.02%.
Memory corruption in Linux kernel on Qualcomm Monaco-based ARM64 platforms causes kernel crashes through synchronous external aborts when accessing hypervisor-owned memory incorrectly marked as conventional RAM. The firmware's EFI memory map only reserves 288 KiB of a 512 KiB Gunyah hypervisor metadata region (0x91a80000-0x91afffff), leaving 224 KiB exploitable for triggering fatal aborts. Patches available for stable branches 6.18.24, 6.19.14, and 7.0 series. EPSS exploitation probability is very low (0.02%, 4th percentile) with no known active exploitation or public POC, indicating limited real-world threat despite CVSS 7.5 rating.
A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memory allocation, enabling local privilege escalation to kernel level. KEV-listed and patched, this vulnerability affects Qualcomm-based mobile devices and embedded systems, potentially impacting billions of Android devices globally.
A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized command execution path during specific GPU command sequences. KEV-listed alongside CVE-2025-21480, this indicates a systemic issue in Qualcomm's GPU micronode command validation that is being actively exploited in mobile attack chains.
Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory corruption during graphics rendering. KEV-listed, this vulnerability can be triggered through Chrome on Android devices with Qualcomm chipsets, providing a kernel-level exploitation path from web content.
Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized command execution during specific GPU command sequences. KEV-listed, this vulnerability enables privilege escalation from the GPU context, potentially allowing app-level attackers to gain kernel access through the GPU driver on Qualcomm-based Android devices.
Memory corruption while maintaining memory maps of HLOS memory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Memory corruption in DSP Services during a remote call from HLOS to DSP. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSH_IDLE when the link was never enabled msm_dp_display_atomic_enable() returns early when link training fails, leaving ->power_on false and the main link down. msm_dp_display_atomic_disable() nevertheless writes DP_STATE_CTRL_PUSH_IDLE and waits for an idle-pattern completion that cannot arrive, so every failed enable is followed by "PUSH_IDLE pattern timedout". Every other step of the teardown is already gated on that flag: msm_dp_display_disable(), called from .atomic_post_disable(), returns early on !power_on. The PUSH_IDLE write is the only one that is not, so the controller's runtime-PM reference is then dropped without the link having been taken down. On glymur (Snapdragon X2 Elite) the consequence is not a warning. The SoC does not survive it: TrustZone force-stops the SOCCP and ADSP remote processors and the machine resets silently about 50 ms later, with no oops and no panic. On an ASUS Zenbook A16 (UX3607OA), whose eDP panel does not currently train, this reproduces without any compositor or GPU involvement: # eDP enable has already failed with "Failed link training (rc=-104)" echo 1 > /sys/class/graphics/fb0/blank [535.645455] === marker === [535.694833] qcom_q6v5_pas d00000.remoteproc: fatal error received: \ sys_m_smsm.c:512:TZ force stop [535.694875] remoteproc remoteproc0: crash detected in soccp: type fatal error [535.728857] qcom_q6v5_pas 6800000.remoteproc: fatal error received: \ sys_m_smsm.c:783:err fatal notification received from TZ <SoC reset> Gate the PUSH_IDLE write on ->power_on so the disable path is consistent with the rest of the teardown. With this applied the same sequence is harmless and the machine stays up; without it, it resets every time. The unconditional write dates back to the original DP driver (c943b4948b58 ("drm/msm/dp: add displayPort driver support")), but the surrounding code has been restructured several times since, so no Fixes: tag is offered. Note that the eDP link-training failure that exposes this on the A16 is a separate problem in the glymur eDP PHY and is reported separately; this change is about not damaging the machine when training fails, for whatever reason. Tested on ASUS Zenbook A16 (UX3607OA), Snapdragon X2 Elite Extreme, on linux-next next-20260803 and next-20260807. The machine has since been running next-20260807 with this patch as its daily driver. Patchwork: https://patchwork.freedesktop.org/patch/745167/
Memory corruption in Qualcomm Snapdragon platforms allows an attacker who already holds a low-privileged local foothold on the device to corrupt memory by feeding oversized input into a copy routine that exceeds expected allocation limits, giving high impact to confidentiality, integrity, and availability of the affected component. The flaw is not remotely exploitable on its own: exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) - for example a malicious or compromised application able to reach the vulnerable code path - and no user interaction is needed. No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided; the referenced Qualcomm September 2026 security bulletin is the authoritative source for the specific affected chipsets and fixed versions.
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations.
NULL pointer dereference in the Linux kernel's ASoC QCOM QDSP6 subsystem crashes systems built on Qualcomm SA8775P and SC8280XP SoCs during ADSP protection-domain restart cycles. The crash occurs because the q6apm-audio .remove callback prematurely deletes Runtime Descriptions (RTDs) containing q6apm DAI components during ASoC teardown, leaving those components still linked to the sound card and triggering a kernel oops on the subsequent rebind. Impact is limited to availability (kernel panic/denial of service); no public exploit has been identified at time of analysis, and EPSS at 0.02% reflects very low widespread exploitation probability.
Memory Corruption when processing invalid user address with nonstandard buffer address. [CVSS 7.8 HIGH]
Memory Corruption when adding user-supplied data without checking available buffer space. [CVSS 7.8 HIGH]
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. [CVSS 7.8 HIGH]
Memory Corruption when accessing trusted execution environment without proper privilege check. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - is affected by reachable assertion (CVSS 6.5).
5G Fixed Wireless Access Platform Firmware versions up to - contains a vulnerability that allows attackers to cryptographic issue when a VoWiFi call is triggered from UE (CVSS 7.2).
Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. [CVSS 7.8 HIGH]
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. [CVSS 7.8 HIGH]
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. [CVSS 7.1 HIGH]
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. [CVSS 7.8 HIGH]
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. [CVSS 7.8 HIGH]
Memory corruption while handling different IOCTL calls from the user-space simultaneously. [CVSS 7.8 HIGH]
Memory Corruption when accessing buffers with invalid length during TA invocation. [CVSS 7.8 HIGH]
5G Fixed Wireless Access Platform Firmware versions up to - is affected by reachable assertion (CVSS 6.5).
A race condition in the Linux kernel's serial driver allows local attackers with low privileges to bypass TTY device linkage during console configuration, potentially enabling unauthorized access to serial console interfaces on Qualcomm SoCs and other affected systems. The vulnerability stems from improper initialization ordering that fails to configure tty->port before uart_configure_port() is called, creating a window where user-space applications can open the console without proper driver linkage. No patch is currently available.
Transient DOS when processing a received frame with an excessively large authentication information element. [CVSS 6.5 MEDIUM]
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. [CVSS 7.8 HIGH]
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. [CVSS 7.8 HIGH]
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. [CVSS 7.8 HIGH]
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. [CVSS 7.1 HIGH]
Memory corruption while calculating offset from partition start point. [CVSS 6.8 MEDIUM]
Memory corruption when calculating oversized partition sizes without proper checks. [CVSS 6.8 MEDIUM]
Memory Corruption when multiple threads simultaneously access a memory free API. [CVSS 7.8 HIGH]
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. [CVSS 7.8 HIGH]
Memory corruption occurs when a secure application is launched on a device with insufficient memory. [CVSS 7.8 HIGH]
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. [CVSS 6.5 MEDIUM]
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. [CVSS 7.8 HIGH]
Memory corruption when accessing resources in kernel driver. [CVSS 7.8 HIGH]
Memory corruption while passing pages to DSP with an unaligned starting address. [CVSS 7.8 HIGH]
Memory corruption while preprocessing IOCTLs in sensors. [CVSS 7.8 HIGH]
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. [CVSS 5.5 MEDIUM]
Memory Corruption when multiple threads concurrently access and modify shared resources. [CVSS 7.8 HIGH]
Memory corruption while processing identity credential operations in the trusted application. [CVSS 7.8 HIGH]
Memory corruption while processing a secure logging command in the trusted application. [CVSS 7.8 HIGH]
Cryptographic issue may occur while encrypting license data. [CVSS 8.4 HIGH]
Memory corruption while handling sensor utility operations. [CVSS 6.7 MEDIUM]
Video Collaboration Vc3 Platform Firmware versions up to - contains a security vulnerability (CVSS 7.8).
Memory corruption while deinitializing a HDCP session. [CVSS 7.8 HIGH]
Memory corruption while accessing a synchronization object during concurrent operations. [CVSS 6.7 MEDIUM]
Memory corruption while performing sensor register read operations. [CVSS 6.7 MEDIUM]
Memory corruption while parsing clock configuration data for a specific hardware type. [CVSS 6.7 MEDIUM]
Memory corruption while processing shared command buffer packet between camera userspace and kernel. [CVSS 6.7 MEDIUM]
Memory corruption while handling buffer mapping operations in the cryptographic driver. [CVSS 6.6 MEDIUM]
Memory corruption while processing a config call from userspace. [CVSS 6.7 MEDIUM]
Information disclosure while processing a firmware event. [CVSS 6.1 MEDIUM]
Transient DOS while parsing video packets received from the video firmware. [CVSS 5.5 MEDIUM]
Memory corruption in Qualcomm firmware's Generic Packet Router (GPR) lets a locally present, low-privileged attacker escalate to root-level code execution on a broad range of Snapdragon, FastConnect, QAM/QCA/QCN and related chipsets. Per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw requires an existing foothold as an unprivileged local process - a malicious or compromised app, for example - which then routes an oversized data packet through the GPR path that bridges user and root/kernel contexts, triggering a CWE-190 integer overflow and full compromise of confidentiality, integrity and availability. It is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis; Qualcomm published the issue in its December 2025 security bulletin for OEM distribution.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Asserting RST_N low. - Turning off REF_CLK. - Turning off VCC. - Turning off VCCQ/VCCQ2. As part of ufs shutdown, after the SSU command completion, asserting hardware reset (HWRST) triggers the device firmware to wake up and execute its reset routine. This routine initializes hardware blocks and takes a few milliseconds to complete. During this time, the ICCQ draws a large current. This large ICCQ current may cause issues for the regulator which is supplying power to UFS, because the turn off request from UFS driver to the regulator framework will be immediately followed by low power mode(LPM) request by regulator framework. This is done by framework because UFS which is the only client is requesting for disable. So if the rail is still in the process of shutting down while ICCQ exceeds LPM current thresholds, and LPM mode is activated in hardware during this state, it may trigger an overcurrent protection (OCP) fault in the regulator. To prevent this, a 10ms delay is added after asserting HWRST. This allows the reset operation to complete while power rails remain active and in high-power mode. Currently there is no way for Host to query whether the reset is completed or not and hence this the delay is based on experiments with Qualcomm UFS controllers across multiple UFS vendors.
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its. No vendor patch available.
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.