CVE-2025-21446: Qualcomm Fastconnect 6900 DOS Vulnerability

CVE-2025-21446 Overview

CVE-2025-21446 is a transient denial-of-service vulnerability affecting a broad range of Qualcomm WLAN firmware components. The flaw occurs when the firmware processes vendor-specific information elements while parsing a WLAN frame carrying BSS Transition Management (BTM) requests. An attacker on the wireless network can send a crafted frame to trigger the condition without authentication or user interaction. Qualcomm associates the issue with CWE-126 (Buffer Over-read) and CWE-125 (Out-of-bounds Read). Hundreds of Snapdragon, FastConnect, IPQ, QCA, and WCN chipsets used in smartphones, automotive platforms, networking gear, and IoT devices are affected.

Critical Impact

Network-adjacent attackers can remotely trigger a transient denial of service against Wi-Fi connectivity on devices using vulnerable Qualcomm chipsets, disrupting communications for mobile, automotive, and infrastructure deployments.

Affected Products

• Qualcomm FastConnect 6700, 6800, 6900, and 7800 Wi-Fi/Bluetooth subsystems
• Snapdragon mobile platforms including 8 Gen 1/2/3, 8+ Gen 1/2, 865/870/888 5G, and 778G/780G/782G
• Qualcomm IPQ, QCA, QCN, and WCN networking and connectivity chipsets used in routers, IoT, and automotive devices

Discovery Timeline

• 2025-07-08 - CVE-2025-21446 published to NVD
• 2025-07 - Qualcomm releases fixes in the July 2025 Security Bulletin
• 2025-08-11 - Last updated in NVD database

Technical Details for CVE-2025-21446

Vulnerability Analysis

The vulnerability resides in the WLAN firmware code path that parses 802.11 management frames carrying BSS Transition Management (BTM) requests. BTM is part of the 802.11v amendment and allows access points to recommend that a client roam to a different AP. During parsing, the firmware iterates through information elements (IEs), including vendor-specific IEs identified by element ID 221. The parser fails to correctly validate the declared length of these vendor-specific IEs against the remaining frame buffer. When a malformed length is encountered, the firmware reads past the end of the buffer, leading to a transient denial of service that disrupts Wi-Fi connectivity until the subsystem recovers or restarts.

Root Cause

The root cause is insufficient bounds checking when processing vendor-specific information elements. The flaw maps to CWE-126 (Buffer Over-read) and CWE-125 (Out-of-bounds Read). The parser trusts attacker-supplied length fields embedded in the BTM request, allowing reads outside the allocated frame buffer.

Attack Vector

The attack vector is network-adjacent and requires no authentication or user interaction. An attacker within wireless range can broadcast or unicast a crafted 802.11 management frame containing a malformed vendor-specific IE inside a BTM request. Targets associated with a rogue or impersonated access point parse the frame and trigger the out-of-bounds read in the WLAN firmware. The result is a transient DoS that interrupts wireless service. Confidentiality and integrity are not directly impacted, but loss of connectivity affects safety-relevant systems such as connected vehicles and critical IoT.

No public proof-of-concept code or in-the-wild exploitation has been reported for CVE-2025-21446. See the Qualcomm July 2025 Security Bulletin for technical details from the vendor.

Detection Methods for CVE-2025-21446

Indicators of Compromise

• Repeated WLAN subsystem crashes, firmware restarts, or kernel log entries referencing WLAN driver faults on affected Qualcomm chipsets
• Unexpected disconnects and reassociations clustered around the receipt of 802.11v BTM Request frames
• Wireless captures showing BTM Request action frames containing oversized or malformed vendor-specific IEs (element ID 221)

Detection Strategies

• Deploy a wireless intrusion detection system (WIDS) to inspect 802.11 management frames and flag BTM Request action frames with malformed IE length fields
• Correlate device crash telemetry (kernel panics, WLAN subsystem resets) with nearby 802.11 activity to identify abuse patterns
• Monitor for rogue or unauthorized access points advertising BTM capability in environments where it is not expected

Monitoring Recommendations

• Centralize mobile, automotive, and IoT device telemetry to surface clusters of WLAN service interruptions tied to specific locations
• Alert on any access point originating BTM Request frames that do not match approved wireless infrastructure inventory
• Track Qualcomm firmware versions across the fleet and flag devices that remain on pre-July 2025 patch levels

How to Mitigate CVE-2025-21446

Immediate Actions Required

• Identify devices and OEM products that integrate the affected Qualcomm chipsets listed in the July 2025 Security Bulletin
• Apply OEM firmware updates that incorporate the Qualcomm fix as soon as they become available for each device family
• Restrict use of untrusted Wi-Fi networks for high-value mobile, automotive, and IoT assets until patches are deployed

Patch Information

Qualcomm released fixes for CVE-2025-21446 in the July 2025 Security Bulletin. End-user devices receive the fix through downstream OEM firmware and Android security updates. Operators of networking, automotive, and IoT platforms should obtain corresponding firmware images from their device vendors and validate that the bulletin's CVE identifier is referenced in release notes before deployment.

Workarounds

• Where supported, disable 802.11v BSS Transition Management on managed enterprise wireless controllers to reduce exposure to crafted BTM frames
• Connect sensitive devices only to enterprise WPA2/WPA3-Enterprise networks with strong AP authentication to limit rogue AP attacks
• Segment vulnerable IoT, automotive, and infrastructure devices onto isolated SSIDs and VLANs to limit the blast radius of WLAN disruption

# Example: disable BTM (802.11v) on a hostapd-based AP as a temporary mitigation
# Edit /etc/hostapd/hostapd.conf and ensure the following:
bss_transition=0
wnm_sleep_mode=0
# Then reload hostapd
sudo systemctl restart hostapd