8
CVEs
1
Critical
4
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Wcd9380 Firmware
706
Wsa8830 Firmware
684
Wsa8835 Firmware
684
Qca6574au Firmware
657
Wcd9385 Firmware
635
Wcd9370 Firmware
594
Wsa8810 Firmware
582
Wsa8815 Firmware
582
Qca6696 Firmware
579
Qca6595au Firmware
560
Sa6155p Firmware
557
Qca6391 Firmware
553
Wcd9375 Firmware
547
Sa8155p Firmware
540
Qca6574a Firmware
521
Wcn3988 Firmware
516
Sdx55 Firmware
511
Wcn3950 Firmware
498
Wcn3980 Firmware
495
Sa8195p Firmware
488
Wcd9341 Firmware
482
Wcd9340 Firmware
466
Qca6574 Firmware
450
Fastconnect 7800 Firmware
439
Fastconnect 6900 Firmware
436
Sa6145p Firmware
431
Qca6595 Firmware
422
Qca8081 Firmware
420
Sd865 5g Firmware
413
Qca8337 Firmware
408
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53046 | Denial-of-service (NULL-pointer dereference / use-after-free) in the Linux kernel's in-kernel SMB3 server (ksmbd) affects systems that offload SMB3 message encryption to asynchronous hardware crypto engines such as the Qualcomm Crypto Engine (QCE). ksmbd_crypt_message() installs a NULL completion callback and misinterprets the -EINPROGRESS return from async AEAD requests as a fatal error, freeing the request while the hardware DMA is still running so the later qce_skcipher_done() callback dereferences freed memory and crashes the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), consistent with the narrow hardware/configuration prerequisites despite the NVD CVSS of 9.8. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-64188 | Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-43347 | Memory corruption in Linux kernel on Qualcomm Monaco-based ARM64 platforms causes kernel crashes through synchronous external aborts when accessing hypervisor-owned memory incorrectly marked as conventional RAM. The firmware's EFI memory map only reserves 288 KiB of a 512 KiB Gunyah hypervisor metadata region (0x91a80000-0x91afffff), leaving 224 KiB exploitable for triggering fatal aborts. Patches available for stable branches 6.18.24, 6.19.14, and 7.0 series. EPSS exploitation probability is very low (0.02%, 4th percentile) with no known active exploitation or public POC, indicating limited real-world threat despite CVSS 7.5 rating. | HIGH | 7.5 | 0.0% | 38 |
|
| CVE-2026-64550 | Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation. | HIGH | 7.3 | 0.2% | 37 |
|
| CVE-2026-46055 | Out-of-bounds read in the Linux kernel's AppArmor LSM subsystem (security/apparmor/match.c) allows a local low-privileged user to trigger a KASAN slab-out-of-bounds read via the mount() syscall on kernels 7.0 through 7.0.3 and 7.1-rc1. The flaw stems from a missing string terminator that causes aa_dfa_match() to read past the end of an 8KB kmalloc buffer when processing mount path strings, resulting in potential information disclosure and system instability (denial of service). No public exploit identified at time of analysis, and EPSS probability is negligible at 0.02%. | HIGH | 7.1 | 0.0% | 36 |
|
| CVE-2026-64100 | Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed. | MEDIUM | 5.5 | 0.2% | 28 |
|
| CVE-2026-53339 | NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations. | MEDIUM | 5.5 | 0.2% | 28 |
|
| CVE-2026-43412 | NULL pointer dereference in the Linux kernel's ASoC QCOM QDSP6 subsystem crashes systems built on Qualcomm SA8775P and SC8280XP SoCs during ADSP protection-domain restart cycles. The crash occurs because the q6apm-audio .remove callback prematurely deletes Runtime Descriptions (RTDs) containing q6apm DAI components during ASoC teardown, leaving those components still linked to the sound card and triggering a kernel oops on the subsequent rebind. Impact is limited to availability (kernel panic/denial of service); no public exploit has been identified at time of analysis, and EPSS at 0.02% reflects very low widespread exploitation probability. | MEDIUM | 5.5 | 0.0% | 28 |
|