5
CVEs
1
Critical
2
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Wcd9380 Firmware
706
Wsa8830 Firmware
684
Wsa8835 Firmware
684
Qca6574au Firmware
657
Wcd9385 Firmware
635
Wcd9370 Firmware
594
Wsa8810 Firmware
582
Wsa8815 Firmware
582
Qca6696 Firmware
579
Qca6595au Firmware
560
Sa6155p Firmware
557
Qca6391 Firmware
553
Wcd9375 Firmware
547
Sa8155p Firmware
540
Qca6574a Firmware
521
Wcn3988 Firmware
516
Sdx55 Firmware
511
Wcn3950 Firmware
498
Wcn3980 Firmware
495
Sa8195p Firmware
488
Wcd9341 Firmware
482
Wcd9340 Firmware
466
Qca6574 Firmware
450
Fastconnect 7800 Firmware
439
Fastconnect 6900 Firmware
436
Sa6145p Firmware
431
Qca6595 Firmware
422
Qca8081 Firmware
420
Sd865 5g Firmware
413
Qca8337 Firmware
408
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53046 | Denial-of-service (NULL-pointer dereference / use-after-free) in the Linux kernel's in-kernel SMB3 server (ksmbd) affects systems that offload SMB3 message encryption to asynchronous hardware crypto engines such as the Qualcomm Crypto Engine (QCE). ksmbd_crypt_message() installs a NULL completion callback and misinterprets the -EINPROGRESS return from async AEAD requests as a fatal error, freeing the request while the hardware DMA is still running so the later qce_skcipher_done() callback dereferences freed memory and crashes the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), consistent with the narrow hardware/configuration prerequisites despite the NVD CVSS of 9.8. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-64188 | Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-64550 | Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation. | HIGH | 7.3 | 0.2% | 37 |
|
| CVE-2026-64100 | Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed. | MEDIUM | 5.5 | 0.2% | 28 |
|
| CVE-2026-53339 | NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations. | MEDIUM | 5.5 | 0.2% | 28 |
|